mone-dox[.]org

Analysis of the domain mone-dox.org indicates it was actively involved in a crypto scam phishing campaign impersonating Binance, as evidenced by its page title 'MONEDOX' and explicit classification in threat intelligence sources. The domain resolved to IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. Infrastructure analysis reveals the domain was registered on May 12, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently associated with high-risk domains. At the time of assessment, only 2 of 95 security vendors on VirusTotal flagged the domain, suggesting limited initial detection coverage.

The domain appeared on one security blocklist and was specifically blocked by PhishDestroy, corroborating its malicious classification. Trust indicators further support the domain's fraudulent nature: Scamadviser assigned a trust score of 1/100, while Gridinsoft rated it 0/100, both consistent with confirmed scam activity. The SSL certificate, identified as R10, is commonly associated with low-cost or automated certificate issuance, often leveraged in phishing infrastructure. The domain's current status is offline, though this does not preclude reactivation or reuse of associated infrastructure.

Defenders are advised to monitor related IPs, particularly 198.12.80.250, and domains registered via the same registrar for recurring threats. Given the domain's explicit targeting of Binance users, organizations handling cryptocurrency transactions should prioritize blocking this domain and its resolved IP across security controls. No additional page content or phishing kit details are currently available for further classification.