monarex[.]io

The domain monarex.io was registered on September 04, 2025 through NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.97.3, which is hosted by Cloudflare, Inc. (AS13335) in the United States. DNS resolution is serviced by the Cloudflare name servers curt.ns.cloudflare.com and leah.ns.cloudflare.com, and the site is delivered over HTTP/3. An HTTP 520 response code is observed, indicating a Cloudflare-origin error, while the TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint. The page title returned from the site reads "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Monarex," suggesting a cryptocurrency exchange façade that directly references the Ethereum brand.

The infrastructure receives a Gridinsoft trust score of 0 out of 100, reflecting a highly suspicious rating. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, and it appears on a single security blocklist. Additionally, the domain is listed as blocked by PhishDestroy, reinforcing its classification as a brand‑impersonation campaign targeting Ethereum users.

While the visible title indicates a financial‑service lure, no further content has been captured, leaving the exact phishing mechanics, credential‑capture pages, or malicious payloads unverified. Defenders should prioritize immediate blocking of monarex.io at network perimeter and DNS filtering layers, monitor for related domains resolved to the same Cloudflare IP range, and update threat‑intel feeds with the registrar and name‑server details. Continuous observation of any new detections from additional sandbox or URL‑reputation services is recommended to capture potential evolution of the campaign.