portal[.]madness[.]finance

Analysis of portal.madness.finance, observed on July 24, 2026, shows a domain that has been taken offline but retains several high‑confidence malicious indicators. The domain resolves to the single IPv4 address 175.41.162.43, which belongs to ASN 16509 operated by Amazon.com, Inc. and is geolocated in Singapore. No SSL certificate is presented for the host, and DNS queries return NS_NOT_FOUND, suggesting that the authoritative name servers have been removed or the domain has been deliberately disabled. The page title returned during the brief live period was "Madness - The Lead DEX Built on Monad - ...", a generic description that does not reference the targeted brand.

However, intelligence flags the site as an impersonation of Magic Eden, and the scam type is classified as Wallet/Seed Phishing, indicating that any credential‑capture page would likely request private keys or seed phrases. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of reputation. VirusTotal analysis shows that 2 of 95 scanned security vendors flagged the domain, providing additional independent confirmation of malicious activity.

The combination of Amazon‑hosted infrastructure, lack of TLS, zero trust score, and brand‑targeted phishing classification points to a purposeful attempt to harvest cryptocurrency wallet credentials. Uncertainty remains around the exact content of the phishing page, as the site was offline before a full content scrape could be performed, and no additional sub‑domains or redirection chains have been observed. Defensive recommendations include immediate blocking of the IP address 175.41.162.43 at perimeter devices, adding portal.madness.