claim-satlayer[.]xyz

The claim-satlayer.xyz domain has been identified as a brand impersonation threat, specifically targeting Across, with no known drainer kit involvement.

This domain was flagged by 5 security vendors out of 95 on VirusTotal, resolving to the IP address 104.21.17.207, and was created on February 21, 2026, with a current SSL certificate issued by WE1, and it appears on 5 security blocklists, further solidifying its malicious intent.

The claim-satlayer.xyz domain is currently offline, which may be a result of response actions taken to mitigate its threat, however, users are still advised to exercise caution and verify the legitimacy of any domain before interacting with it, especially those related to cryptocurrency transactions, as the risk of similar impersonation threats remains elevated, and PhishDestroy continues to monitor for potential re-emergence or new threats with a unique seed f7e797.