claim-radiantcapital[.]app

The domain claim-radiantcapital.app was registered through OwnRegistrar, Inc. and is currently taken offline, but historical evidence indicates it was used for a brand‑impersonation campaign targeting the "radiant" brand. The site returned the HTTP title "Just a moment..." and was classified as a crypto‑related scam, suggesting that victims may have been directed to cryptocurrency wallets or payment pages. Infrastructure analysis shows the domain resolved to IP address 172.67.174.182, which belongs to AS13335 Cloudflare, Inc., a widely used content‑delivery network. The authoritative name servers are donovan.ns.cloudflare.com and dora.ns.cloudflare.com, both operated by Cloudflare.

No SSL certificate was observed for the domain, implying that any traffic would have been unencrypted, a characteristic often seen in rapid‑deployment phishing kits. The domain appears on a single security blocklist and was blocked by PhishDestroy, confirming that at least one defensive feed recognized it as malicious. VirusTotal recorded scans from 95 antivirus vendors, none of which flagged the domain as malicious; however, the absence of detections does not constitute a safety guarantee. The combination of a brand‑impersonation label, the crypto‑scam designation, and the use of a generic Cloudflare front end aligns with known tactics for short‑lived phishing operations that aim to harvest cryptocurrency credentials or funds.

Defenders should continue to block claim‑radiantcapital.app at perimeter filters, monitor the associated IP address for any resurgence of malicious activity, and add the domain to threat‑intel feeds. Because the site is offline, active investigation may be limited, but the registrar, hosting provider, and name‑server details should be logged for future correlation with similar campaigns.