monad[.]moonrises[.]xyz

This domain, monad.moonrises.xyz, poses a high-risk brand impersonation threat targeting users of the Monad platform. Analysis indicates the site mimics official Monad events, presenting itself under the page title 'Monad Moonrises | Events' to deceive visitors into believing it is a legitimate communication channel. The objective appears to be credential harvesting, unauthorized fund transfers, or distribution of malicious payloads under the guise of an official event portal. The use of a seemingly authentic title and branding elements increases the likelihood of successful social engineering attacks against Monad users and affiliates. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on May 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.145.145, hosted on AS13335 (Cloudflare, Inc.), which is commonly used to obfuscate origin servers. Detection metrics confirm its malicious nature: 11 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on two independent security blocklists. Additionally, the domain is actively blocked by at least two real-time phishing detection systems, further corroborating its role in ongoing fraudulent campaigns. Users who have visited monad.moonrises.xyz or interacted with its content should take immediate remediation steps. Any credentials entered on the site must be considered compromised and reset across all platforms where identical or similar passwords were used. System scans using updated security tools should be conducted to detect potential malware or backdoors installed during the visit. Organizations should monitor network logs for connections to 172.67.145.145 or the domain itself and implement domain-based blocking at the perimeter. Affected users are advised to report the incident to relevant security teams and, if applicable, financial institutions to prevent unauthorized transactions linked to the compromise.