claymolandaks[.]top

On July 25, 2026, analysts examined the domain claymolandaks.top, which was registered on November 28, 2025 through the registrar 耐思尼克国际集团有限公司. The site resolves to the IP address 172.67.221.237, an endpoint owned by AS13335 Cloudflare, Inc. and geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued to the WE1 entity, indicating that the connection is encrypted with a widely trusted root. HTTP requests to the site return status code 525, suggesting an SSL handshake failure at the origin server, a pattern often observed in malicious infrastructure that relies on Cloudflare as a front‑end shield.

Infrastructure fingerprints show the presence of Hostinger as the underlying hosting platform, Cloudflare Browser Insights, and support for HTTP/3, all of which are consistent with a fast‑path content delivery configuration. The domain’s authoritative nameservers are camilo.ns.cloudflare.com and serena.ns.cloudflare.com, confirming Cloudflare’s DNS services are in use.

Reputation checks reveal that six of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single external blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. The site is actively listed by PhishDestroy as a blocked resource. The page title returned by the server is "Clay Molandaks Mainnet Mint," and the threat classification is recorded as a crypto scam that impersonates the brand monad. No additional content analysis is available, leaving the exact phishing vector (e.g., credential harvesting page, malicious smart‑contract interaction) unconfirmed.

Defenders should prioritize blocking DNS resolution for claymolandaks.top and any subdomains, enforce TLS inspection to capture the 525 response, and add the IP 172.67.221.237 to network‑level deny lists.