mon-claim[.]xyz

Analysis of the domain mon-claim.xyz indicates a brand‑impersonation campaign targeting the cryptocurrency service “Monad”. The site was registered on 21 February 2026 and currently returns an HTTP status of offline, suggesting the operators have taken the infrastructure down after a brief exposure. DNS resolution points to the IP address 172.67.198.99, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate presented on the host is identified as “WE1”, a certificate commonly observed on malicious hosting services.

VirusTotal has recorded seven detections out of ninety‑three scanned engines, confirming that multiple security products consider the domain malicious. The domain appears on a single external blocklist and is specifically listed by the PhishDestroy service. Additional reputation data shows a Gridinsoft trust score of zero out of one hundred, reinforcing the malicious classification. The page title returned by the server is “Monad Claim Portal”, matching the declared scam type of a crypto‑related claim fraud.

No further behavioural data such as redirects, payloads, or credential‑harvesting forms are publicly available because the site is offline. Defenders should block any network traffic to 172.67.198.99 and add mon‑claim.xyz to URL filtering policies. Monitoring of Cloudflare‑hosted address ranges for similar rapid‑deployment domains is advisable, as is the inclusion of the domain in threat‑intel feeds used by endpoint detection platforms. Continuous re‑query of VirusTotal and blocklist services is recommended to capture any re‑activation attempts.