mon-flip[.]vercel[.]app

Analysis indicates high risk classification for mon-flip.vercel.app, identified as a generic_phishing threat designed to mimic MonFlip and potentially harvest user credentials or sensitive input data. The domain is currently active, increasing exposure risk for unsuspecting users interacting with the page. The threat category is confirmed as phishing based on multi-engine detection signals and browser-level blocking.

Technical indicators show VirusTotal detection ratio of 11/95 security vendors flagging the domain. The infrastructure resolves to IP 216.198.79.67 hosted in the US under AS16509 Amazon.com, Inc. The SSL certificate is issued by Google Trust Services / WR1, indicating automated TLS provisioning. The domain was created on February 21, 2026 and is registered via Tucows Domains Inc. It appears on 1 security blocklist and is actively flagged by Google Safe Browsing for phishing activity. Current status remains active.

Mitigation requires immediate blocking of mon-flip.vercel.app across DNS, web proxy, and endpoint filtering systems. Security teams should ingest indicators including IP 216.198.79.67 and associated domain patterns into threat intelligence feeds. Users should be warned against entering credentials or personal data on any MonFlip-branded pages delivered from this domain. If interaction has occurred, credential resets and session invalidation should be enforced, along with monitoring for unauthorized access attempts.