buy-monad-sell[.]com

The domain buy‑monad‑sell.com is currently active and was registered on 17 Nov 2025 through SOLLUTIUM LLC. It resolves to the IPv4 address 176.97.124.200, which belongs to AS6698 Virtual Systems LLC and is geolocated in Ukraine. DNS resolution is handled by ns1.zomro.net, ns2.zomro.ru, ns3.zomro.com and ns4.zomro.su. An HTTPS service is available via a Let’s Encrypt certificate (R13) and the web server reports Nginx with HTTP Strict Transport Security enabled; the HTTP response code is 200. The page title returned by the server is “Buy and Sell Monad Without KYC | Fast Anonymous Crypto Swap”, indicating a crypto‑related brand‑impersonation campaign targeting the Monad brand. Threat intelligence shows the domain appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask and SEAL. VirusTotal analysis recorded 11 detections out of 91 scanners, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The risk level is classified as high. Current uncertainties include the precise content of the landing page beyond the title and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the host. Defenders should block network connections to 176.97.124.200, add the domain to URL filtering policies, and monitor for any related indicators such as the listed nameservers or the Let’s Encrypt certificate fingerprint. Continuous re‑assessment is advised as the campaign remains active.