testnet-monod[.]top

This domain, testnet-monod.top, was operational as a credential harvesting site designed to impersonate Discord, a widely used communication platform. The phishing infrastructure specifically targeted users involved in cryptocurrency testnet activities, as indicated by the page title 'Monad Testnet: Test, Play and Build on Monad Testnet.' The site likely presented itself as a legitimate Discord login portal or testnet participation page to deceive victims into entering sensitive credentials, such as usernames, passwords, or wallet recovery phrases. Given the context of cryptocurrency testnets, the attackers may have also aimed to exploit users' expectations of experimental or promotional access to blockchain networks, increasing the likelihood of successful credential theft. Analysis of the domain's infrastructure reveals multiple indicators of malicious activity. The domain was created on November 23, 2025, and registered through Hosting Concepts B.V. d/b/a Registrar.eu. It resolved to the IP address 172.67.173.149 and is currently flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on four independent security blocklists and has been preemptively blocked by multiple threat detection systems. A Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk domain. The combination of these technical indicators, including the recent creation date and low vendor detection ratio, suggests the domain was part of a short-lived but targeted phishing campaign. Users who visited testnet-monod.top should assume their credentials or sensitive information may have been compromised. Immediate actions include changing passwords for Discord and any associated accounts, particularly those linked to cryptocurrency wallets or testnet participation. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor financial and communication accounts for signs of misuse, such as unauthorized transactions or messages sent from compromised accounts. If wallet recovery phrases or private keys were entered, consider transferring assets to a new wallet and revoking access from the compromised one. Report the incident to relevant security teams or fraud reporting platforms to assist in broader mitigation efforts.