claim-monad[.]world

This domain, claim-monad.world, is actively impersonating Monad, a targeted brand in a high-risk phishing campaign. Registered on March 11, 2026, through OwnRegistrar, Inc., the domain currently resolves to IP address 188.114.96.3 and is protected by Cloudflare infrastructure, as indicated by the presence of HTTP/3 and HSTS technologies. The domain has been flagged by 12 out of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and BLP-Malware. Additionally, it has been referenced in 24 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition of its malicious nature. Analysis of the domain's SSL certificate reveals it is issued by Google Trust Services, a common practice among threat actors to lend legitimacy to phishing sites. The page title, 'Just a moment...', is consistent with Cloudflare's interstitial challenge pages, which may indicate the site is either awaiting user interaction or attempting to evade automated detection mechanisms. The domain's Gridinsoft trust score of 0/100 further corroborates its classification as malicious. Despite these indicators, the domain remains active as of July 12, 2026, posing an ongoing risk to users. Defenders should prioritize blocking this domain at the network perimeter, particularly given its association with brand impersonation and the use of Cloudflare to obfuscate its true hosting details. The domain's inclusion in multiple threat intelligence feeds and its low trust score justify immediate action, such as adding it to internal blocklists and monitoring for related indicators of compromise. While the exact phishing kit or payload remains unconfirmed, the domain's infrastructure and historical data suggest it is part of a larger campaign targeting Monad users. Organizations should also review logs for connections to the resolving IP address, 188.114.96.3, as it may host additional malicious domains.