claim[.]monacl[.]xyz

Analysis of claim.monacl.xyz shows a high‑risk brand‑impersonation infrastructure targeting Google users with a crypto‑scam profile. The domain was registered on February 21, 2026 through NameCheap, Inc. and resolves to the Cloudflare IP address 104.21.0.156, which is associated with AS13335 in the United States. Cloudflare services are confirmed by the presence of Cloudflare and HTTP/3 in the technology fingerprint, and the site presents an SSL certificate issued by Google Trust Services under the WE1 label, a tactic commonly used to lend legitimacy to malicious pages. The HTTP response for the queried URL returns a 403 status code, indicating that direct access is currently blocked, yet the domain remains listed as active in threat feeds.

Security vendors have flagged the domain on six of ninety‑three scans at VirusTotal, and it appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The page title retrieved from the site reads "YouTubeRU — Смотрите YouTube без зависаний," a Russian‑language phrase unrelated to Google, suggesting that the content may be serving a lure unrelated to the advertised brand. Defenders should treat any traffic to claim.monacl.xyz as malicious.

Blocking the domain at perimeter firewalls, DNS resolvers, and web proxies is advised. Monitoring for similar Cloudflare‑hosted domains with Google Trust Services certificates and low trust scores can help identify related campaigns. Because the site returns a 403 response, threat actors may be employing additional delivery mechanisms such as redirects or credential‑harvesting forms that are not exposed by a simple GET request; therefore, deeper inspection of outbound connections and user‑initiated requests to this domain is recommended. Continued observation of the domain’s status in blocklists and VirusTotal scans will be essential for timely updates.