monadavatars[.]xyz

Analysis as of July 25, 2026 indicates that monadavatars.xyz is an active brand‑impersonation infrastructure targeting the monad brand. The domain was registered on November 21, 2025 through HOSTINGER operations, UAB and resolves to the IP address 34.120.137.41, which belongs to AS396982 owned by Google LLC and is geolocated in the United States. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, and the domain does not present an SSL/TLS certificate, leaving HTTP traffic unencrypted. The page title returned during the last crawl reads “Abraxus Collective Pixel Art NFTs | Monad Avatars”, suggesting an attempt to associate the monad brand with NFT‑related content. No additional page content has been captured, and the site is currently offline.

Detection telemetry shows that five of ninety‑five antivirus and URL‑reputation engines on VirusTotal flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, confirming a high likelihood of malicious intent. The combination of a low trust score, lack of transport encryption, and presence on multiple threat‑intelligence feeds aligns with the observed brand‑impersonation classification. Uncertainties remain regarding the full payload delivered by the site, as no malware samples or download URLs have been observed. The absence of a valid SSL certificate prevents verification of any potential credential‑harvesting forms, and the offline status limits current threat‑actor activity assessment.

Defenders should block DNS resolution for monadavatars.xyz at the network perimeter, enforce HTTPS inspection where possible, and add the IP address 34.120.137.41 to deny lists. Continuous monitoring of the associated IP range and related WHOIS records is recommended to catch any re‑registration attempts.