monadconnect[.]pages[.]dev

This domain, monadconnect.pages.dev, is an active phishing site designed to impersonate the decentralized exchange 1inch. The site presents itself as a 'Monad Claim Portal,' a fabricated service likely intended to deceive users into connecting their cryptocurrency wallets or entering sensitive credentials. The goal is to harvest private keys, seed phrases, or other authentication details, enabling attackers to drain funds from victims' wallets. Given the high-value target—users of a well-known DeFi platform—the risk of financial loss is significant, particularly for individuals unfamiliar with common phishing tactics in the crypto space. Analysis indicates this domain is engineered for malicious activity. It was registered on November 23, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, also associated with Cloudflare’s infrastructure. The domain lacks an SSL certificate, which is unusual for legitimate services and may serve as a red flag for observant users. Security vendors have flagged the domain as malicious, with 10 out of 95 engines on VirusTotal detecting it as a threat. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. The use of Cloudflare’s infrastructure is notable, as it provides attackers with a degree of anonymity and resilience against takedowns. If you or someone you know has visited monadconnect.pages.dev, immediate action is required to mitigate potential damage. First, disconnect any wallets or accounts that were linked to the site. Next, review all recent transactions for unauthorized activity and revoke any suspicious token approvals using a blockchain explorer or a wallet management tool. Change passwords and enable multi-factor authentication on all related accounts, particularly those tied to cryptocurrency services. If credentials or private keys were entered, consider migrating funds to a new wallet, as the existing one may be compromised. Finally, report the domain to relevant security teams or platforms to help prevent further victimization. Users are advised to verify the authenticity of any claim portals or airdrop sites by cross-referencing official announcements from the legitimate project’s verified channels.