claim[.]mamobot[.]world

Analysis of the domain claim.mamobot.world indicates it is an active crypto drainer phishing site, first registered on February 21, 2026, through Web Commerce Communications Limited. As of July 24, 2026, the domain resolves to the IP address 104.21.80.1, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site employs Cloudflare nameservers (hasslo.ns.cloudflare.com and aisha.ns.cloudflare.com) and utilizes HTTP/3, a protocol often leveraged to enhance performance and evade basic detection mechanisms. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites to secure connections. VirusTotal detection data reveals that 4 out of 91 security vendors have flagged this domain as malicious, a modest but notable detection rate that suggests early identification by some threat intelligence providers.

The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which specialize in identifying phishing and scam infrastructure. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as a high-risk domain. The page title, 'mamobot.world | 521: Web server is down,' indicates a server-side error, which may be intentional to obscure malicious activity or a temporary operational issue. The scam type is explicitly categorized as a crypto scam, aligning with the broader trend of crypto drainers targeting users through deceptive websites. Despite the server error, the domain remains active, and defenders should treat it as a live threat.

Infrastructure analysis reveals no direct attribution to a specific phishing kit or brand impersonation beyond the 'crypto scam' classification. The use of Cloudflare services is consistent with threat actors seeking to mask their origin and evade takedown efforts. Organizations are advised to block the domain and its associated IP (104.21.80.