claim-kimchi[.]pages[.]dev

The domain claim-kimchi.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.179, which belongs to AS13335 Cloudflare, Inc. in the United States. The site was served over HTTPS using a Let’s Encrypt certificate (issuer E7) and employed HSTS, Cloudflare edge services, and HTTP/3. The page title returned by the server was "Suspected phishing site | Cloudflare," and the site has been classified as a crypto scam, specifically a crypto drainer.

Security telemetry shows that the domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and has a Gridinsoft trust score of 0 out of 100. VirusTotal analysis recorded a single positive detection out of 93 scanning engines. The domain’s current status is offline, but historical evidence indicates malicious intent.

Analysts should continue to block the domain at network perimeter and DNS layers, monitor the associated IP for any re‑activation, and add the domain to internal threat intelligence feeds. Because the site was taken down, further content analysis is not possible, leaving the exact phishing vector unknown. Ongoing vigilance is advised, especially for cryptocurrency wallet applications that may reference the domain in malicious payloads or scripts.