enlist-monad[.]app

The domain enlist-monad.app was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the Cloudflare‑managed address 172.67.212.130, which belongs to AS13335 Cloudflare, Inc. and is hosted in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint. HTTP traffic is served over HTTP/3 and returns a 403 status code, suggesting that the server is actively denying access to the requesting client.

The page title observed during the brief scan was "Nur einen Moment…", a German phrase meaning "Just a moment…"; no further content was captured before the service was taken offline. VirusTotal analysis shows that 10 of 93 scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The domain’s primary malicious intent is identified as brand impersonation targeting the technology brand Monad.

The infrastructure utilizes Cloudflare’s edge network, which can obscure the true origin of the payload, and the nameservers are adam.ns.cloudflare.com and danica.ns.cloudflare.com. While the site is currently offline, the observed indicators suggest an active phishing campaign that may have been distributing malicious links or credential‑harvesting pages under the guise of Monad. Defenders should add the IP address 172.67.212.130 to network‑level deny lists, monitor for new domains resolving to the same Cloudflare edge nodes, and enforce URL filtering policies that block access to enlist-monad.app. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and security teams should update endpoint protection signatures to reflect the 10 vendor detections reported by VirusTotal.