link[.]mon-l1[.]com

The domain link.mon-l1.com is a phishing site engaged in brand impersonation targeting Twitch users. It presents itself as a legitimate link aggregation service but is designed to deceive victims into entering credentials or personal information under the guise of the Twitch brand. No crypto drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate risk, though prior exposure may still pose threats to affected individuals.

Technical analysis shows link.mon-l1.com was flagged by 2 of 95 VirusTotal security vendors, including ChainPatrol and SOCRadar, while appearing on one security blocklist (PhishDestroy). The domain was registered through Tucows Domains Inc. on October 16, 2025, and resolves to the IP address 188.114.96.3, hosted by Cloudflare in the US. No SSL certificate was issued for the domain, and its nameservers are kyrie.ns.cloudflare.com and may.ns.cloudflare.com. The observed page title, 'Bio.links - Seus links em um só lugar,' suggests a Portuguese-language interface, potentially targeting specific regional users. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification.

Individuals who interacted with link.mon-l1.com should immediately change any credentials entered on the site, particularly Twitch passwords, and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized activity and report any suspected fraud to the impersonated brand’s support team. Victims may also submit the domain to anti-phishing initiatives such as Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader mitigation efforts.