mocastr[.]com

mocastr.com is currently listed on a security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a lack of trust. VirusTotal analysis shows that three of ninety‑three scanning engines flag the domain as malicious. The site presents an HTTP 403 response and the page title returned is “Just a moment…”, which is commonly used by automated challenge pages. The domain resolves to 188.114.96.3, an IP address owned by AS13335 Cloudflare, Inc., located in the United States.

Cloudflare services are confirmed by the presence of Cloudflare Browser Insights, the Cloudflare name server pair sydney.ns.cloudflare.com and tanner.ns.cloudflare.com, and support for HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 identifier, showing a valid certificate chain but providing no indication of legitimacy. Registration data shows the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, a registrar that does not appear to be flagged. The domain is categorized as a crypto drainer scam, and it has been blocked by the PhishDestroy feed.

The combination of a recent registration, low trust score, blocklist presence, multiple vendor detections, and the use of a Cloudflare‑hosted IP strongly suggests that the infrastructure is being used for malicious phishing or crypto‑draining activity. However, the exact payload or victim‑facing pages have not been observed, and the content behind the “Just a moment…” challenge remains unknown. Defenders should proactively block or sinkhole the domain, include its IP address and name‑server pair in network‑level deny lists, and monitor for any changes in HTTP status or additional detections. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture potential evolution of the payload.