app-monad[.]xyz

On July 23, 2026, the domain app-monad.xyz was identified as a potential brand impersonation targeting Discord. This domain is part of a social media phishing campaign designed to deceive users into believing they are interacting with legitimate Discord services. The domain was created on February 21, 2026, and has since been flagged by 14 out of 93 security vendors on VirusTotal, indicating a significant level of suspicion among the cybersecurity community. The domain is currently offline and no longer resolves to its previously associated IP address, 188.114.96.3, which was located in the United States and hosted by Cloudflare, Inc. (AS13335).

The nameservers for this domain are amir.ns.cloudflare.com and eve.ns.cloudflare.com, further suggesting the use of Cloudflare services for hosting and DNS management. Despite the domain's offline status, it has appeared on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. These blocklists are known for identifying and listing malicious domains and web pages. The exact content of the phishing page is not yet analyzed, but the page title 'Monad Testnet: Test, Play and Build on Monad Testnet' suggests that the domain may have been designed to mimic a testnet or development environment associated with Discord or a related service.

The lack of an SSL certificate adds to the domain's suspicious nature, as legitimate services typically use SSL to secure user data and communications. Defenders are advised to remain vigilant and ensure that their systems and users are aware of the potential risk associated with this domain. Additionally, monitoring for any resurgence of activity on this domain and similar impersonations is crucial to maintaining security.