monerochansol[.]com

Analysis of monerochansol.com (identified as a fake Monero airdrop scam) shows that the domain was registered on 21 February 2026 through Dominet (HK) Limited. The site employed Cloudflare infrastructure, resolving to the IP address 172.67.164.123, which belongs to AS13335 Cloudflare, Inc., and is located in the United States. The TLS certificate was issued by Google Trust Services under the WE1 leaf, indicating a valid HTTPS chain, and the server advertised HTTP Strict Transport Security (HSTS) and HTTP/3 support. The page title returned by the site was “$MONEROCHAN Airdrop”, matching the reported scam kit identified as an Airdrop Scam.

VirusTotal recorded a single detection out of 93 scanned vendors, and the domain appears on three public blocklists. It has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. The domain is currently taken offline, and no further HTTP responses are observed. Defenders should add the hostname monerochansol.com and its resolving IP 172.67.164.123 to network and endpoint blocklists, and ensure that Cloudflare‑associated traffic is inspected for potential re‑use of the same infrastructure.

Although the site is offline, the underlying hosting profile (Cloudflare, HSTS, HTTP/3) is frequently recycled by malicious operators, so future replicas may appear under different subdomains. Continuous monitoring of the registrar Dominet (HK) Limited for newly‑created domains with similar naming patterns is advised. Users of cryptocurrency wallets, particularly those interacting with MetaMask, should be warned that unsolicited airdrop offers referencing “$MONEROCHAN” are fraudulent. Incident response teams can reference the observed indicators of compromise—domain name, creation date, resolver IP, TLS issuer, and blocklist entries—to enrich threat intelligence feeds and improve detection rules.