claims-monad[.]app

Analysis as of July 23, 2026 indicates that the domain claims-monad.app is being used for a brand‑impersonation campaign targeting the Monad brand. The site currently returns an HTTP directory listing with the title “Index of /” and does not present an SSL certificate, exposing any credentials transmitted over the connection. Infrastructure data show the domain is registered via the PL‑SOLLUTIUM‑20210802 registrar and resolves to the IPv4 address 37.16.75.129, which belongs to ASN 43641 operated by SOLLUTIUM EU Sp z.o.o. in the Netherlands. The authoritative nameservers are ns3‑ams.v‑sys.org and ns4‑ams.v‑sys.org, both typical of the hosting provider used for this address range.

Detection services have flagged the domain: thirteen of ninety‑five antivirus and URL‑reputation engines on VirusTotal have generated a positive detection, and the domain appears on a single security blocklist. It has also been listed by PhishDestroy and is flagged by Google Safe Browsing for social‑engineering content. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious classification. No SSL/TLS certificate is available, and the site is currently taken offline, limiting immediate interaction but not removing the threat of reuse of the same infrastructure.

Uncertainty remains regarding the exact payload delivered to victims; the page title provides no indication of a login portal or malicious script, and no further forensic samples have been published. Nevertheless, the combination of brand impersonation, a directory listing, and multiple security vendor detections suggests a deliberate crypto‑scam operation that may have previously attempted to lure users into sending cryptocurrency or personal information. Defenders should block claims‑monad.app at the DNS and proxy layers, add the associated IP address 37.16.75.129 to network‑level blocklists, and monitor the identified nameservers for any resurgence of malicious content.