monad[.]claim-airdrop[.]live

Analysis of the domain monad.claim-airdrop.live indicates it was part of a fraudulent cryptocurrency airdrop scheme, classified as a crypto drainer with elevated risk. The domain was registered on November 25, 2025, through Name.com, Inc., and resolved to an IP address (63.176.8.218) hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. As of July 23, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline or abandoned. Security vendors flagged the domain on VirusTotal, with 16 of 95 detection engines identifying it as malicious. It also appears on at least one security blocklist (PhishDestroy).

The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not provide trust indicators beyond standard encryption. The domain's nameservers (dns1.p05.nsone.net through dns4.p05.nsone.net) are associated with a legitimate DNS provider, which is common in phishing infrastructure to evade immediate suspicion. The page title, matching the domain name (monad.claim-airdrop.live), aligns with the identified scam type: a fake airdrop. This tactic typically lures victims into connecting wallets to malicious smart contracts, resulting in unauthorized token transfers. While the exact content of the site remains unanalyzed, the classification as a crypto drainer is supported by detection data and blocklist inclusion.

Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking is recommended, along with monitoring for related domains using similar naming patterns (e.g., 'claim-airdrop'). Given the domain's current offline status, further compromise attempts may shift to newly registered lookalike domains. No evidence suggests persistence or active exploitation beyond the reported period, but historical logs should be reviewed for connections to this domain prior to its takedown.