monclaim[.]com

Analysis of the domain monclaim.com indicates it was actively involved in a crypto drainer phishing campaign as of July 2026. The domain was registered on November 24, 2025, through Name SRS AB and is associated with Cloudflare nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com. Infrastructure analysis reveals the domain resolved to the IP address 104.21.85.162, hosted under AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected for this domain, and its HTTP response included the page title 'Nur einen Moment…', a common placeholder used during intermediate redirects or loading sequences in phishing operations.

Detection data from security vendors shows limited but targeted flagging: three of ninety-five engines on VirusTotal identified the domain as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy. The scam type is classified as a crypto scam, consistent with crypto drainer activity, where victims are tricked into connecting wallets to malicious smart contracts designed to siphon funds. At the time of this report, monclaim.com is offline, though its prior infrastructure and registration details remain relevant for historical tracking.

Defenders should treat this domain as a confirmed threat vector for crypto-related fraud and include it in blocklists or monitoring systems. The use of Cloudflare nameservers and hosting is notable, as such services are frequently leveraged to obscure the true origin of phishing infrastructure. No further details about the specific brand or platform targeted by this campaign are available from the provided evidence, and the exact content of the phishing page has not been analyzed. Organizations are advised to correlate this domain with other indicators of compromise, particularly those linked to crypto drainer activity, and to monitor for re-registration or re-emergence under similar naming conventions.