claims-moonbirb[.]com

Analysis of claims-moonbirb.com indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are lara.ns.cloudflare.com and otto.ns.cloudflare.com, both belonging to Cloudflare's DNS service. DNS resolution points to IP address 104.21.30.91, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is presented for the site, suggesting that HTTPS is not configured. The HTTP response returns a page titled “Just a moment…”, and the domain is currently marked as offline.

VirusTotal has recorded six positive detections out of ninety‑three scanning engines, confirming that multiple security vendors consider the domain malicious. Independent blocklist monitoring shows the domain listed on three public blocklists and specifically blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto‑related scam. The threat taxonomy supplied labels it as a “Crypto Scam” with a more precise sub‑type of “crypto drainer”, and the risk level is elevated. The available evidence points to a typical infrastructure pattern used by crypto‑draining operations: rapid provisioning on a reputable CDN (Cloudflare), short‑lived domain registration, and absence of TLS to avoid certificate costs. However, the precise payload or transaction‑draining mechanism has not been observed; the page content beyond the title remains un‑analysed, and no malware hashes or command‑and‑control endpoints have been disclosed.

Consequently, the full scope of the threat—such as targeted wallets or phishing forms—remains uncertain. Defenders should immediately add claims-moonbirb.com to DNS‑ and web‑filter block lists, enforce outbound traffic inspection for connections to the associated Cloudflare IP range, and monitor for newly created domains that resolve to the same name servers or IP address.