claim-mstr2100[.]co

Analysis indicates that claim-mstr2100.co was registered on October 17, 2024 through OwnRegistrar, Inc. The authoritative nameservers are fay.ns.cloudflare.com and oswald.ns.cloudflare.com, pointing to Cloudflare’s network (ASN13335). DNS resolution returns the address 188.114.96.3, which is geolocated to the United States and belongs to Cloudflare, Inc. No TLS certificate is presented for the domain, suggesting that the site is served over plain HTTP. The only visible HTML element captured is the page title “Nur einen Moment…”, which provides no indication of the underlying payload.

VirusTotal records show that the domain was scanned by 95 security vendors, none of which raised a detection at the time of analysis; this absence of detections does not constitute a safety guarantee. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy feed, leading to its current offline status. Threat intelligence classifies the site as a crypto‑drainer scam, although no further technical artifacts such as wallet addresses or malicious scripts have been disclosed.

The limited data set leaves several uncertainties: the exact malicious content, command‑and‑control infrastructure, and any compromised credentials remain unknown. Defenders should continue to monitor the domain’s DNS and IP reputation, enforce outbound traffic filtering to Cloudflare edge nodes, and ensure that any internal users are warned about the lack of TLS and the suspicious page title. Blocking the domain at the DNS resolver level and adding the associated IP to deny lists can mitigate the risk while further investigation is underway.