claim-momocoin[.]space

Analysis dated July 24, 2026 flags the domain claim-momocoin.space as an elevated‑risk brand‑impersonation site that presents a fake airdrop targeting Google users. The domain was registered on August 31, 2025 through OwnRegistrar, Inc. and currently resolves to the IP address 172.67.191.156, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers lily.ns.cloudflare.com and mitch.ns.cloudflare.com; the third entry appears as “null”, indicating a possible misconfiguration. No TLS certificate is presented, meaning the site serves HTTP only, which further reduces credibility. The page title returned from the host is “MOMO Coin – Female Shiba”, a reference to a cryptocurrency‑related token rather than Google, suggesting the attacker is leveraging a lure unrelated to the impersonated brand.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. On VirusTotal, two of ninety‑five antivirus engines flagged the domain, providing limited but corroborating evidence of malicious intent. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a hostile payload. No additional public threat‑intel feeds such as OTX or Google Safe Browsing have been reported for this host. Uncertainty remains around the exact content delivered to victims because the site is offline and no HTTP response body has been captured.

Analysts cannot confirm whether the page hosts credential‑stealing forms, malicious downloads, or merely redirects to external cryptocurrency schemes. Nevertheless, the combination of a brand impersonation claim, fake airdrop narrative, low trust score, and the presence of a Cloudflare‑hosted IP with no TLS indicates a high probability of phishing or scam activity. Defenders should add claim-momocoin.space to URL filtering rules, block connections to its IP address, and monitor DNS queries for the associated Cloudflare nameservers.