minting[.]monbirds[.]com

The domain minting.monbirds.com is currently classified as an active crypto drainer with a high risk rating. It was registered on October 2 2025 through INWX GmbH and first appeared on three public blocklists (PhishDestroy, MetaMask, SEAL). The site returns an HTTP 403 response and presents the page title “Just a moment…”. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:3030::ac43:cb54, which is owned by AS13335 Cloudflare, Inc. The authoritative nameservers are heidi.ns.cloudflare.com and jay.ns.cloudflare.com, confirming the use of Cloudflare’s network. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 root. Reputation signals reinforce the malicious classification. The Gridinsoft trust score is 0 out of 100, and VirusTotal reports that three of ninety‑five security vendors have flagged the domain. All three blocklists that list the domain are oriented toward cryptocurrency abuse, aligning with the declared scam type “cryptocurrency”. No additional content has been observed beyond the generic “Just a moment…” title, indicating limited public analysis of the payload. Defenders should block the domain at network and endpoint layers, update DNS filter lists to include the three observed blocklists, and monitor outbound traffic for connections to the listed Cloudflare IPv6 address. Because the domain is hosted behind Cloudflare, investigators may need to request logs from the service provider to trace any downstream infrastructure used for the drainer operation. Continuous re‑evaluation is advised, as the threat actor could shift hosting or alter the front‑end content.