fomonad[.]pages[.]dev

On 23 July 2026 analysts observed that the domain fomonad.pages.dev is serving a page titled “FOMONAD” and is classified as a brand‑impersonation site targeting the monad brand. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.61 located in the United States (AS13335). DNS is hosted on Cloudflare name servers daisy.ns.cloudflare.com and sergi.ns.cloudflare.com. The site presents an HTTPS endpoint signed by Google Trust Services (certificate identifier WE1) and enforces HSTS while supporting HTTP/3. An HTTP request returns status code 403, indicating that the server is actively refusing content delivery.

Google Safe Browsing has flagged the URL for social engineering, and the PhishDestroy blocklist has already taken the domain offline. VirusTotal analysis shows that 12 of 93 security vendors have reported the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one additional security blocklist. The combination of a recent creation date, Cloudflare‑provided infrastructure, a low trust score, and multiple vendor detections suggests a high‑confidence malicious operation aimed at credential harvesting or brand abuse.

Uncertainty remains around the exact payload or phishing page content because the site is currently offline and no visual evidence has been captured. Defenders should add the domain to local deny lists, monitor DNS queries for the associated IP address, and enforce strict outbound filtering for connections to Cloudflare edge nodes that resolve to 172.66.47.61. Continuous re‑scanning with multi‑vendor services is advisable to capture any future changes in the hosting or payload. Organizations that use the monad brand should alert users to the existence of this impersonation attempt and reinforce authentication controls.