claim-monday[.]trade

Analysis of the domain claim-monday.trade confirms its classification as an active crypto drainer phishing site, posing a high risk to users. The domain was registered on May 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. Infrastructure analysis reveals resolution to the IP address 104.21.84.10, hosted under Cloudflare, Inc. in Canada, a common obfuscation tactic to conceal the true origin of the server. The site returns an HTTP 200 status, indicating it is operational, and employs a Let's Encrypt SSL certificate (serial number E7), which provides encryption but does not validate legitimacy. Security vendor detection further supports the malicious classification. As of July 12, 2026, 16 of 91 security vendors on VirusTotal flag the domain as malicious, and it appears on three independent security blocklists. Additional protective measures have been implemented by multiple security entities, including PhishDestroy, MetaMask, and SEAL, which have blocked the domain to prevent user interaction. The Gridinsoft trust score of 0/100 reinforces the domain's association with fraudulent activity. The specific threat type, a crypto drainer, indicates the site is designed to deplete cryptocurrency wallets by tricking users into authorizing malicious transactions. While the exact content and social engineering tactics employed remain unanalyzed, the domain's infrastructure, detection history, and active status provide sufficient evidence for defenders to treat it as a confirmed threat. Network administrators and security teams are advised to block resolution to 104.21.84.10 and monitor for related domains registered through the same registrar or resolving to identical infrastructure. No legitimate use case for this domain has been identified, and user access should be restricted pending further investigation or takedown.