mon-testnet[.]pages[.]dev

Analysis as of July 23, 2026 indicates that the domain mon-testnet.pages.dev is currently offline, returning HTTP 403 for all requests. The domain was registered on October 14, 2025 through Cloudflare, Inc., and resolves to the IP address 172.66.47.178, which belongs to AS13335 Cloudflare in the United States. DNS resolution uses the Cloudflare authoritative name servers adel.ns.cloudflare.com and kipp.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, confirming that HTTPS is enforced via HSTS. Traffic is served over HTTP/3, consistent with typical Cloudflare edge delivery.

The page title observed during the brief scan is "Monad Loading," and the threat classification is listed as brand impersonation targeting the Monad brand. VirusTotal analysis shows that 9 out of 95 security vendors have flagged the domain as malicious. Additionally, the domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious posture. The combination of a recent registration date, Cloudflare‑hosted infrastructure, a low trust score, and multiple vendor detections suggests a deliberate attempt to mimic the Monad brand, likely to harvest credentials or deliver further payloads.

However, the exact payload or credential‑capture mechanism has not been observed, and the content of the landing page beyond the title remains unverified. Defenders should continue to block the domain at perimeter filters, enforce DNS sinkholing for the IP 172.66.47.178, and monitor for any future re‑activation. Users should be warned that any request to mon-testnet.pages.dev is associated with a confirmed brand‑impersonation campaign and should be avoided. Ongoing intelligence collection is recommended to capture any changes in hosting, certificate renewal, or content that could indicate escalation.