monad-capital[.]xyz

monad-capital.xyz was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare’s authoritative nameservers elaine.ns.cloudflare.com and owen.ns.cloudflare.com. DNS resolution points to 172.67.159.6, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 label, confirming that the connection is encrypted via Cloudflare’s edge. HTTP requests return a 403 status code, indicating that access is denied for generic clients, but the presence of a page title “Nur einen Moment…” shows that content is rendered for some requests.

The domain is classified as a brand‑impersonation campaign targeting the brand “monad”, and the scam type is explicitly recorded as brand impersonation. Threat intelligence from PhishDestroy lists the domain as blocked, and it appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that five of ninety‑three scanning engines flag the domain, corroborating the blocklist evidence.

Detected technologies include Cloudflare and HTTP/3, confirming modern delivery infrastructure. The risk rating is high and the campaign remains active as of the report date, 22 July 2026. Defensive recommendations include adding the domain to DNS‑based deny lists, configuring web‑filtering solutions to block HTTP/HTTPS traffic to the address, and monitoring for any credential‑phishing activity that references the monad brand. Analysts should also track changes to the SSL certificate and DNS records, as rapid re‑hosting is common in Cloudflare‑based campaigns.