bafybeigmswkybm6kwmpmedjong4dkbaurrjg4xbw5hwhjvy7ee3ql7hpui[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeigmswkybm6kwmpmedjong4dkbaurrjg4xbw5hwhjvy7ee3ql7hpui.ipfs.dweb.link shows a confirmed brand‑impersonation campaign targeting the Monad project. The domain was registered through CSC Corporate Domains, Inc. on February 24 2017 and currently resolves to the IP address 209.94.90.2, which belongs to AS40680 (Protocol Labs) in the United States. Infrastructure inspection reveals the site was served behind Cloudflare, leveraging HTTP/3 and a Let’s Encrypt E7 certificate, with authoritative name servers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com.

The HTTP response code returned 410, indicating the resource is no longer available, and the site has been taken offline. Security‑vendor telemetry records two detections out of ninety‑five scanners on VirusTotal, and the domain is listed on two blocklists operated by PhishDestroy and ScamSniffer. The page title captured during the brief live period – “Monad | Extreme Parallelized Performance for EVM” – directly mirrors the legitimate Monad branding, confirming the impersonation intent.

While the domain’s current offline status limits immediate threat exposure, the historical presence of a brand‑specific page title, the use of reputable CDN services, and the modest detection count suggest a previously active malicious infrastructure. Defenders should continue to block the domain and its associated IP, monitor for any re‑registration or resurrection of the subdomain, and update detection signatures to include the observed page title and Cloudflare name‑server pattern. Ongoing vigilance is advised, particularly for users of Monad services, to prevent credential harvesting or social‑engineering attempts that may arise from similar impersonation attempts.