monad-faucet-qe5uq[.]ondigitalocean[.]app

This domain, monad-faucet-qe5uq.ondigitalocean.app, was identified as part of a crypto scam infrastructure impersonating MetaMask, a known cryptocurrency wallet service. Analysis as of July 25, 2026, indicates the domain is currently offline, though it previously resolved to 172.66.0.96, hosted on Cloudflare's network (AS13335) in the United States. The SSL certificate was issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains, offering no definitive indication of intent. The page title, 'Monad x winks.fun,' suggests a connection to a crypto-related promotion or giveaway, though the exact mechanics of the scam remain unconfirmed due to the lack of active page content for review. Detection data is limited but notable: two of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist, specifically PhishDestroy.

Gridinsoft assigned a trust score of 0/100, reinforcing suspicions of malicious activity. The domain was registered through MarkMonitor Inc., a registrar frequently used for both legitimate and fraudulent purposes. Technologies detected on the infrastructure include Amazon Web Services, Google Analytics, and Cloudflare, which are commonly leveraged in phishing campaigns to enhance credibility and evade detection. Defenders should treat this domain as part of a broader crypto scam operation targeting MetaMask users.

While the domain is offline, monitoring for reactivation or migration to similar infrastructure (e.g., subdomains, newly registered domains with comparable naming patterns) is recommended. Blocking the resolved IP (172.66.0.96) and associated Cloudflare nameservers (elias.ns.cloudflare.com, sydney.ns.cloudflare.com) may mitigate residual risk. Given the low but present detection rate, reliance on additional threat intelligence sources (e.g., Safe Browsing, OTX) is advised to confirm its status.