Cracked crypto wallet with classified breach data and surveillance feed overlay.

Domain dossier / preserved indicators

Redacted domain dossier, minus the house style

We are far too editorially nervous to tell you whether the upstream publisher is correct. We can, however, preserve the dossier, keep the indicators readable, and route every external exit through the source gate.

Domain fileIndicators preservedSource gate wrapped

Open source gate Archive FAQ Registrar ledger

File /domain/d1-r0yFY0aypDy_ozK8ofGxljG8od/·Source voice preserved·Brand labels redacted

THE ENABLERS REGISTRY AI

HIGH

This domain, [REDACTED], poses a high-risk brand impersonation threat targeting users of the Monad platform. Analysis indicates the site mimics official Monad events, presenting itself under the page title 'Monad Moonrises | Events' to deceive visitors into believing it is a legitimate communication channel. The objective appears to be credential harvesting, unauthorized fund transfers, or distribution of malicious payloads under the guise of an official event portal. The use of a seemingly authentic title and branding elements increases the likelihood of successful social engineering attacks against Monad users and affiliates. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on May 20, 2026, through [REDACTED], a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.145.145, hosted on AS13335 ([REDACTED]), which is commonly used to obfuscate origin servers. Detection metrics confirm its malicious nature: 11 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on two independent security blocklists. Additionally, the domain is actively blocked by at least two real-time possibly phishing detection systems, further corroborating its role in ongoing fraudulent campaigns. Users who have visited [REDACTED] or interacted with its content should take immediate remediation steps. Any credentials entered on the site must be considered compromised and reset across all platforms where identical or similar passwords were used. System scans using updated security tools should be conducted to detect potential malware or backdoors installed during the visit. Organizations should monitor network logs for connections to 172.67.145.145 or the domain itself and implement domain-based blocking at the perimeter. Affected users are advised to report the incident to relevant security teams and, if applicable, financial institutions to prevent unauthorized transactions linked to the compromise.

VirusTotal

11 det.

URLScan

Report ↗

Gridinsoft

0/100

SSL

Let's Encrypt

Age

2 mo New

Observed status

Cloaked · reachable

DestroyList

Listed

Reports Sent

Data coverage VirusTotal 11 / 91 URLQuery no detections OTX no pulses CF Radar clean URLScan report ready DNS blocks none SSL valid, 81d WHOIS 2 mo old Screenshot not captured Redirect chain not probed Gridinsoft 0/100

Network Security Intelligence Registrar Integrity Alert

High-Risk Registrar IANA #3765

THE ENABLERS REGISTRY audit found that over 90% of domains registered through IANA #3765 are associated with illegal content. This registrar systematically ignores abuse reports and its primary clientele consists of CIS-region scam operators. We have not identified a single legitimate project hosted on this registrar.

IANA #3765 Verdict Full Investigation

Threat Response Pipeline

Discovery

Checks

Reports

Availability

11/12

Pre-emptive Discovery & Ingestion

Threat Ingested

1/1 ✓

Threat Ingested

[REDACTED] detected and queued for full analysis

May 28, 2026

Threat Intelligence Checks

IANA #1910 Radar · VirusTotal · Google Safe Browsing · Blocklist Detection · High-Risk Registrar: IANA #3765 · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded

8/8 ✓

IANA #1910 Radar

Scanned via IANA #1910 Radar — DNS, certificates & network data

VirusTotal

11 / 91 vendors flagged on VirusTotal

May 28, 2026

Google Safe Browsing

Checked via Google Transparency Report

May 28, 2026

Blocklist Detection

Found in 1 blocklist: ScamSniffer

Jul 24, 2026

High-Risk Registrar: IANA #3765

90%+ illegal content — registrar ignores abuse reports. Read our verdict

Brand Impersonation

Impersonation of Monad

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Jul 24, 2026

Notification Records

Abuse Reports Sent

1/1 ✓

Abuse Reports Sent

Abuse report sent to registrar [REDACTED], hosting provider, 1 abuse contact

May 28, 2026

Publication & Availability

DestroyList Published · Monitoring Continues

1/2

DestroyList Published

Listed in the public THE ENABLERS REGISTRY/DestroyList repository

May 28, 2026

Monitoring Continues

The domain remains reachable or access-restricted; future checks may update this observation

Public Blocklist Status

Confirmed in 2 datasets: THE ENABLERS REGISTRY + 1 independent public blocklist — ScamSniffer

10 external threat databases checked; 1 matched. Last synchronized Jul 24, 2026. THE ENABLERS REGISTRY database match: confirmed.

Redacted domain dossier, minus the house style

Threat Response Pipeline

Public Blocklist Status

Evidence Capture

Domain Intelligence

VirusTotal Analysis

Evidence & External Reports

Were You Affected by This Site?

Report to Your Local Authorities

Related Domain Reports

Other Domains on 172.67.145.145 2 possibly phishing domains

More Domains at IANA #3765 6 flagged

Other Monad Impersonation Domains

About This Report: [REDACTED]

Check Any Domain

Report Possibly phishing

Live Threat Feed

Stay Informed, Stay Safe

Recommendations & Advice for Victims

Archive note