staking[.]imperamonad[.]xyz

On 24 July 2026 the domain staking.imperamonad.xyz was observed and subsequently taken offline. The domain was registered on 20 March 2026 through Porkbun, LLC and uses the authoritative name servers curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador. The zone resolves to the IP address 185.199.108.153, which is owned by GitHub, Inc. and geolocated to the United States. No TLS certificate is presented for the host, indicating that HTTPS was not configured at the time of analysis. The site delivered content identified as “RPG MONAD MINET — Staking Vault”, a page title that aligns with the declared brand impersonation of the Monad project.

Technical fingerprinting revealed the presence of Varnish, GitHub Pages, jsDelivr, and Fastly in the response chain, suggesting that the attacker leveraged publicly available hosting and CDN services to serve the malicious payload. Reputation services flagged the domain. Nine of ninety‑four security vendors on VirusTotal reported a detection, and the site appears on three external blocklists. Google Safe Browsing classified the domain as a social engineering threat, while PhishDestroy, MetaMask, and SEAL have explicitly blocked it. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

The risk rating assigned is high, consistent with the brand‑impersonation intent targeting Monad users. While the domain is currently offline, the infrastructure components—namely the GitHub‑hosted IP and the use of generic CDN services—remain reusable for future campaigns. Defenders should update URL filtering rules to include staking.imperamonad.xyz, enforce blocklist ingestion from the cited sources, and monitor the associated IP address for any reactivation. Additionally, organizations that interact with the Monad brand should educate users about the absence of a valid TLS certificate and the misleading “Staking Vault” terminology.