enlist-monad[.]net

The domain enlist-monad.net is a confirmed phishing site engaged in brand impersonation targeting Monad, a recognized cryptocurrency platform. It poses an elevated risk by attempting to deceive users into believing they are interacting with the legitimate Monad brand, potentially leading to credential theft or fraudulent transactions. No drainer kit was identified, and the site is currently taken offline.

Technical indicators confirm enlist-monad.net as malicious. As of analysis, 3 of 95 VirusTotal security vendors flagged the domain, including alphaMountain.ai, Gridinsoft, and SOCRadar. The domain was registered on 2025-12-02 04:23:02 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 104.21.19.146, hosted on Cloudflare’s network (AS13335). It appears on 1 security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Nur einen Moment…', and the site employed Cloudflare technologies, including Browser Insights and HTTP/3.

Users who interacted with enlist-monad.net should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on their Monad account, and monitor for unauthorized transactions. If cryptocurrency was involved, revoke any token approvals granted to suspicious contracts. Report the phishing domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), and the impersonated brand (Monad) to aid in takedown efforts. Victims may also file complaints with local cybercrime authorities or platforms like IC3.gov.