mo-change[.]com

This domain, mo-change.com, is flagged as a high-risk brand impersonation threat targeting Monad, a blockchain platform. Analysis of the page title, 'Anonymous Monad Crypto Swap Without KYC Or Registration,' indicates an attempt to lure users into interacting with a fraudulent cryptocurrency swap service, likely designed to harvest credentials or drain wallets. The domain exhibits characteristics typical of a drainer kit, including the promise of anonymity and the absence of KYC requirements, which are common tactics in crypto-related phishing schemes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335). It was registered on November 25, 2025, through SOLLUTIUM LLC. The SSL certificate is issued by Let's Encrypt (R12). Detection metrics show 14 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. No presence on Google Safe Browsing was observed at the time of analysis. As of the latest assessment, mo-change.com has been taken offline, reducing immediate exposure to end users. However, the domain remains registered, and the infrastructure (IP, registrar, and SSL certificate) could be repurposed for future malicious campaigns. The remaining risk includes potential re-activation of the domain or migration of the phishing kit to a new domain under the same registrar. Users and organizations are advised to monitor for similar domains registered through SOLLUTIUM LLC, particularly those leveraging Cloudflare IPs and Let's Encrypt certificates. Blocking the IP 188.114.96.3 and implementing DNS-based protections against newly registered domains with similar naming patterns (e.g., 'mo-*') is recommended for proactive defense.