@Cloudd (X)

This listing combines three separate signals into one picture. The handle sits one character from known blacklisted entities (Cloud Token, USDT Cloud Mining 2026, and an OpenPhish-listed CloudFront host). The profile bio advertises "DM for Promo" — paid promotion. And the posts push a specific altcoin, MONI on Monad, with a contract address (0x0CC9B2e2AcD7BACfF79eb7dB48F5662B622E7777) and a Telegram link (t.me/MoniOnMonad). A paid-promotion account posting a contract address is the standard delivery mechanism for a low-liquidity token launch: buyers arrive from the post, price rises on thin liquidity, and the holders who arranged the promotion sell into it. The contract address is recorded here so anyone can check the token's holder distribution and liquidity themselves before touching it.

Originally published on GACS — Global Anti-Crime & Safety. Verify the latest status of this report at https://gacs.app/scam/cloudd-x-9450c2. Browse the full public scam registry, see live scam alerts, or report a scam. © GACS · Licensed CC BY 4.0 with attribution to gacs.app.

1. 1Operate a handle near-identical to known scam brands so search traffic mixes.
2. 2Advertise paid promotion in the bio.
3. 3Post a contract address plus a Telegram group for a specific low-liquidity token.
4. 4Buying pressure from the post exits into existing holders.

• Handle within one character of blacklisted entities including an OpenPhish-listed host.
• "DM for Promo" stated in the profile bio.
• Token contract address and Telegram link posted publicly.

Limits of this evidence: Posting a contract address is not itself proof of a rug pull. The finding is the combination: paid promotion, typo-squat proximity, and an unaudited low-liquidity token.

• Handle is one character away from a known blacklisted scam: Cloud Token, USDT Cloud Mining 2026, OpenPhish: d2n9osbflux4k6.cloudfront.net. Typo-squatting is the #1 impersonation tactic — double-check the spelling matches the real account
• Promotion of specific altcoin 'MONI on Monad' with a contract address (0x0CC9B2e2AcD7BACfF79eb7dB48F5662B622E7777) and a Telegram link (t.me/MoniOnMonad) in Post 3. This often indicates shilling or pump-and-dump schemes
• Profile bio states 'Dm for Promo', indicating paid promotions which can be used to shill dubious projects

• Engaging in 'shill me some NFTs to buy' (Post 5) can attract scam projects to promote
• 'Professional Degenerate' in bio, while possibly a self-aware joke, often aligns with high-risk, speculative crypto activities that can lead to scams
• Use of shortened link t.co/9kBOhtpwuq in the bio, which obfuscates the destination URL and can be redirected to malicious sites

The operator registers a handle that wraps a real brand name in an extra word — support, giveaway, recovery, airdrop, official — so it looks like a department of the company. Victims searching for help find the fake account before the real one, and the conversation moves straight to direct messages where there is no moderation and no record.

• The genuine account never bolts words like "official", "support" or "airdrop" onto its handle
• Account is far younger than the brand it claims to represent
• First move is always to take you into a private chat
• Asks for a seed phrase, a screen-share, or a "verification" transfer

• FTC — Reporting crypto scams and impersonation
• FBI IC3 — Public service announcements on impersonation fraud

Sources and method

• OpenPhish

  Threat feed that listed the related CloudFront phishing host.

• SEC Investor.gov — Social media and investment fraud

  Undisclosed paid promotion of a token is a documented fraud pattern.

• GACS social scanner

  Our scanner reads the public profile and recent posts, scores the behavioural signals, and re-checks the account on a schedule so a listing reflects current behaviour, not a single moment.

• Primary observation

  The page or profile this listing was created from.

• 1 community report

  Independent submissions from people who ran into this. Reports are matched on the identifier, not the name, so renaming does not reset the count.

Checked against our live signals at listing time and re-checked whenever the identifier appears in a new report or feed update. This listing has also been reviewed by hand: the narrative above was written from the observed evidence, not generated. If you believe this listing is wrong, you can appeal it and we will re-check the evidence.