monaxai[.]fun

Analysis of monaxai.fun indicates a confirmed brand-impersonation campaign targeting users of the Compound platform. The domain was registered with NameCheap, Inc. on November 24, 2025 and is currently offline. Infrastructure inspection shows the domain resolves to IP address 76.76.21.98, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com, reflecting a typical registrar‑provided configuration.

No SSL certificate is present, leaving the site vulnerable to man‑in‑the‑middle interception and confirming the lack of legitimate encryption. The page title returned by the host, "Monad AI Agent Builder – Deploy AI Agents for DeFi," bears no relation to the Compound brand, underscoring the deceptive intent. Security‑vendor scanning on VirusTotal reports five detections out of ninety‑five scanners, reinforcing the malicious classification. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy.

Independent reputation scoring by Gridinsoft assigns a trust score of 0 out of 100, indicating extreme risk. While the exact phishing page content has not been captured, the converging evidence—brand impersonation, crypto‑scam labeling, low trust score, vendor detections, and blocklist presence—provides a strong basis for confirming the site as a fraudulent actor. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor for any future DNS re‑activation, and update endpoint protection signatures to reflect the five VirusTotal detections. Continuous observation of the registrar’s WHOIS records is advised to detect potential re‑registration attempts, and any inbound traffic to the IP should be logged and investigated for malicious payload delivery.