app-monad[.]biz

The domain app-monad.biz was registered on 21 February 2026 through Dynadot LLC and is currently delegated to the Cloudflare nameservers damiete.ns.cloudflare.com and meadow.ns.cloudflare.com. DNS resolution points to the Cloudflare edge address 172.67.189.66, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an HTTP 3 enabled service behind Cloudflare and returns an HTTP 521 status code, indicating that the origin server is unavailable. The TLS handshake is performed with a certificate issued by Google Trust Services under the WE1 root, confirming the use of a legitimate public‑key infrastructure but offering no assurance about the underlying content.

Brand‑impersonation activity is indicated by the explicit claim that the page impersonates the Monad brand, and the page title “Building automation, energy management, smart lighting, security systems, transportation and infrastructure management” aligns with Monad’s product portfolio. The domain has been added to at least one security blocklist and was flagged by the PhishDestroy service. VirusTotal analysis shows that two of ninety‑three scanning engines reported malicious behavior, providing independent confirmation of suspicious activity.

While the HTTP 521 response prevents direct verification of the landing page, the combination of recent registration, Cloudflare‑only hosting, a valid Google‑issued certificate, and the presence on blocklists strongly suggests an active brand‑impersonation campaign. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated nameservers, and add the IP address 172.67.189.66 to reputation‑based deny lists. Because the underlying content cannot be retrieved, further investigation through controlled sandbox access is recommended to capture any payloads or credential‑harvesting forms that may be served once the origin becomes reachable.