moonad[.]mom

Analysis of moonad.mom, a domain created on November 27, 2025 and currently taken offline, reveals multiple indicators of a brand‑impersonation operation targeting Ethereum users. The site resolves to IP address 172.67.206.193, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration details show the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are coraline.ns.cloudflare.com and toby.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No SSL certificate is present, meaning the site served traffic over plain HTTP, a common trait in many illicit campaigns that rely on quick deployment rather than encryption.

The page title observed before takedown was "MONAD AIRDROP," and the campaign is classified as a wallet/seed phishing operation employing an "Airdrop Scam" phishing kit. VirusTotal scans flagged the domain on 15 of 95 security vendor engines, indicating a notable detection rate across multiple anti‑malware products. Additionally, the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, further corroborating its malicious reputation.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence in the domain’s legitimacy. While the offline status limits immediate interaction, defenders should continue to monitor the associated IP address and Cloudflare nameservers for reuse in future campaigns, enforce blocklisting of the domain in web filtering solutions, and educate Ethereum users about unsolicited airdrop offers that request private keys or seed phrases. The lack of an SSL certificate, the use of a known phishing kit, and the low trust score collectively suggest that moonad.mom was designed to harvest cryptocurrency credentials rather than provide a legitimate service.