monadchristmas[.]xyz

Analysis of monadchristmas.xyz as of July 23, 2026 shows an elevated‑risk brand‑impersonation infrastructure targeting the Monad brand. The domain was registered on December 12, 2025 through ERANET INTERNATIONAL LIMITED and is delegated to Cloudflare nameservers jonah.ns.cloudflare.com and leah.ns.cloudflare.com. DNS resolution points to IP address 172.67.190.137, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating the site was served without HTTPS protection.

Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the malicious assessment. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. AlienVault OTX references the domain in one threat‑intelligence pulse, confirming its inclusion in broader community feeds. VirusTotal scans have generated 16 positive detections out of 95 security vendors, reflecting consistent identification of the site as malicious across multiple engines.

Current online status is offline, but the observed infrastructure components suggest the domain was active in recent campaigns. Uncertainties remain regarding the exact payload or phishing page content, as no page title or SSL details were captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑use of the associated IP range or Cloudflare nameservers, and update detection rules to flag future registrations that resolve to the same IP or use the same registrar pattern. Ongoing threat‑intel correlation with the Monad brand is advised to detect any emerging impersonation attempts.