m0nad-clalm[.]com

The domain m0nad-clalm.com was registered on October 19, 2025 through NiceNIC International Group Co., Limited. Its authoritative nameservers are aryanna.ns.cloudflare.com and malcolm.ns.cloudflare.com, directing traffic to the Cloudflare edge at IP 104.21.52.192, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. No TLS certificate is presented, indicating the site is served without HTTPS encryption. Public analysis shows the site presents a page titled “Monad Claim Portal” and is classified as a wallet/seed phishing campaign targeting the “monad” brand.

VirusTotal reports 14 of 95 scanning engines flag the domain as malicious, and the domain appears on at least one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The current status is reported as taken offline, but the underlying Cloudflare edge remains reachable. Defenders should add the domain to DNS blacklists, update web‑proxy and firewall rules to drop any HTTP requests to the host, and monitor outbound traffic for attempts to resolve the domain.

Because the site lacks TLS, any attempted connections will be visible in network captures, allowing further attribution. Continuous monitoring of the associated Cloudflare IP range and the registrar NiceNIC for new registrations that resemble the same naming pattern is also recommended. No additional content such as login forms or scripts has been publicly disclosed, so the exact mechanics of the seed harvesting remain unknown. Given the multiple vendor detections, blocklist listing, and the explicit “Monad Claim Portal” title, the domain should be treated as high‑confidence malicious infrastructure aimed at harvesting cryptocurrency wallet seeds from victims who believe they are interacting with a legitimate monad service.