claim[.]viralmoguls[.]net

The domain claim.viralmoguls.net was registered on April 12, 2025 through Network Solutions, LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is delegated to Cloudflare nameservers dayana.ns.cloudflare.com and toby.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and possibly its edge services. No SSL/TLS certificate was observed for the site, meaning connections would be unencrypted if the service were reachable.

The page title returned by the HTTP response is "VMOG Token Claim Portal," aligning with the classified scam type of a crypto drainer. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, providing external confirmation of malicious intent. A Gridinsoft trust score of 0 out of 100 further underscores the low reputation of the host. VirusTotal records indicate that the domain was scanned by 95 antivirus and URL‑reputation engines, none of which flagged it at the time of scanning; however, the absence of detections does not constitute verification of safety.

For defenders, the presence of the domain on a blocklist, the lack of TLS, the association with a known crypto‑drain scam page title, and the zero trust score collectively suggest that traffic to claim.viralmoguls.net should be blocked at perimeter defenses. Monitoring for any re‑activation of the domain or related IP addresses is recommended, as threat actors may redeploy the infrastructure under a new host or domain. Additionally, organizations should update endpoint and web‑filtering solutions with the observed indicators of compromise, including the domain name, IP address, and associated Cloudflare nameservers, to mitigate potential exposure to similar crypto‑drainer campaigns.