xn--monshot-5lb[.]com

This domain, xn--monshot-5lb.com, is actively engaged in brand impersonation targeting Celer Network, a blockchain interoperability protocol. The threat type is classified as high-risk due to its deceptive infrastructure designed to mimic legitimate Celer services, potentially facilitating credential harvesting, unauthorized transactions, or fraudulent token distributions under the guise of a "Vote to List" campaign. Analysis of technical indicators reveals multiple red flags. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to IP address 172.67.150.174, hosted on Cloudflare infrastructure (AS13335). Security vendors have flagged this domain in 14 of 95 VirusTotal scans, while it appears on three independent security blocklists. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as fraudulent domains frequently leverage valid certificates to appear legitimate. Additional evidence includes active blocking by at least three security mechanisms, including browser-based transaction protection systems. Current infrastructure and threat intelligence confirm this domain remains active and poses a credible risk to users interacting with Celer Network or related blockchain services. Immediate mitigation steps include blocking the domain at the network level, alerting users to avoid interaction, and monitoring for associated IP addresses or subdomains. Organizations should update endpoint protection rules to include this domain and its resolved IP as indicators of compromise. Users who may have engaged with this domain should revoke active sessions, rotate credentials, and verify transaction histories for unauthorized activity.