claim-steer[.]finance

On 25 July 2026, the domain claim-steer.finance was observed as an active crypto‑drainer infrastructure before being taken offline. The domain was registered on 6 January 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, Inc., resolving to the IPv4 address 104.21.43.60 located in Canada. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. Five independent security blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have already listed the domain, and VirusTotal reports that five of ninety‑three scanning engines flagged it as malicious.

The page title returned by the server is identical to the domain name, “claim-steer.finance”, providing no additional context about the payload or the targeted victims. No further evidence regarding SSL certificate details, HTTP response codes, or content analysis is available because the site is currently offline. The limited public data points to a classic crypto‑scam operation that likely attempts to lure cryptocurrency owners into transferring assets to attacker‑controlled wallets.

Defenders should proactively block the domain and its associated IP address at network perimeters, update endpoint detection rules with the observed VirusTotal signatures, and monitor for any resurgence of the same registrar or hosting provider in new registrations. Continuous observation of the listed blocklists is recommended to capture any re‑use of the infrastructure. Until additional forensic artifacts become available, the domain should be treated as a high‑confidence indicator of a crypto‑drainer campaign.