sale-monprotocol[.]pages[.]dev

Analysis of sale-monprotocol.pages.dev indicates a cryptocurrency presale phishing domain, currently under investigation. The domain was registered on June 13, 2026, through Cloudflare, Inc., and resolves to IP address 188.114.96.3. The page title, "MON Protocol Community Presale," suggests a focus on cryptocurrency or token presale activity, though the exact content and functionality of the site remain unconfirmed. Infrastructure analysis reveals the use of Cloudflare hosting and security services, including HSTS and HTTP/3, alongside third-party libraries such as Unpkg, SweetAlert2, jsDelivr, and crypto-js, which may be employed to enhance site interactivity or obfuscate malicious behavior. The domain appears on one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft. No vendor detections were reported at the time of the most recent scan, though this absence does not confirm the domain's safety. The SSL certificate is issued by Google Trust Services, a common provider for both legitimate and malicious domains. Given the domain's recent registration and association with cryptocurrency presale themes, defenders should treat it as a potential phishing threat targeting users involved in token sales or decentralized finance (DeFi) projects. Further investigation is required to determine the domain's exact mechanisms, such as wallet-draining scripts, fake token contracts, or credential harvesting. Network defenders are advised to monitor for connections to 188.114.96.3 and consider blocking the domain at perimeter security controls pending additional analysis. No confirmed brand impersonation or specific phishing kit has been identified at this stage.