monproto[.]pages[.]dev

The domain monproto.pages.dev is currently active and categorized as a high-risk phishing site impersonating the MON Protocol Community Presale. Analysis confirms it is designed to deceive users into participating in a fraudulent token presale, likely harvesting credentials or cryptocurrency transfers under false pretenses. The domain was registered through Cloudflare, Inc., and no legitimate affiliation with the MON Protocol project or its official entities has been verified. Infrastructure analysis reveals the domain resolves to the IP address 172.66.44.93, hosted on Cloudflare infrastructure in Canada. It was created on March 22, 2026, and is flagged by 4 of 95 security vendors on VirusTotal. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and presents a page titled 'MON Protocol Community Presale.' The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to mimic legitimacy. Current status remains active, posing an ongoing threat to users seeking early access to MON Protocol tokens. Users are advised to avoid interacting with this domain, verify all presale announcements through official MON Protocol channels, and report any suspicious links to security teams. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for related phishing campaigns targeting cryptocurrency communities.