monvision[.]run

Analysis of monvision.run indicates that the domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are reese.ns.cloudflare.com and rosalyn.ns.cloudflare.com, pointing to Cloudflare’s infrastructure. DNS resolution returns the address 172.67.186.224, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was observed, suggesting the site was delivered over HTTP only. The page title returned from the site, “MySpace Wallet – Monad Portfolio Tracker | MonadVision,” references the brand “monad” and aligns with the listed scam type of wallet/seed phishing.

VirusTotal scanning recorded 12 detections out of 93 participating security vendors, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigned a trust score of zero out of one hundred, indicating a complete lack of confidence. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting coordinated mitigation by multiple anti‑phishing services. Current host status is reported as offline, which is consistent with the domain being taken down or otherwise inaccessible.

Because the site is offline, the precise HTML structure, form fields, and any embedded malicious scripts remain unverified. The combination of a recent registration, Cloudflare hosting without TLS, a brand‑impersonating page title, multiple vendor detections, a zero trust score, and inclusion on blocklists provides strong evidence that monvision.run was used for credential or seed harvesting targeting users of the monad ecosystem. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and advise affected users to verify the authenticity of wallet interfaces before entering private keys or seed phrases.