monero-chan[.]net

PhishDestroy identifies monero-chan.net as a generic phishing threat targeting users of the Monero cryptocurrency platform. The domain impersonates the official Monero project by using the title 'Monero-Chan | The Open-Source Privacy Platform', a clear attempt to deceive visitors into believing they are on a legitimate site. While no specific drainer kit has been publicly associated with this domain, the phishing infrastructure is designed to harvest sensitive information or credentials from unsuspecting users.

Technical indicators provide strong evidence of malicious intent. VirusTotal reports that 2 out of 95 security vendors flag this domain as malicious. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar known for low-cost and often anonymous registrations. It resolves to IP address 188.114.96.3, which is associated with Cloudflare, a common service used by phishers to mask their true hosting. The SSL certificate is issued by Google Trust Services / WE1, giving the site a false sense of legitimacy. The domain appears on 3 security blocklists, and Google Safe Browsing (GSB) has not yet taken action, though it may be pending review.

As of this report, monero-chan.net is offline, which suggests that either the hosting provider or registrar has taken action, or the threat actor has voluntarily taken it down. PhishDestroy recommends that users who have interacted with this domain change any passwords or credentials entered and monitor for suspicious activity. While the immediate risk is reduced due to the domain being offline, users should remain vigilant, as similar phishing domains may reappear. Always verify URLs before entering sensitive information, and use PhishDestroy's tools to check the safety of any cryptocurrency-related site.