claim-syrupfi[.]co

Analysis of claim-syrupfi.co shows a domain that was created on October 25, 2024 through OwnRegistrar, Inc. and currently resolves to the Cloudflare‑owned address 104.21.96.1 (AS13335, United States). The site presents the page title “Nur einen Moment…”, but no SSL certificate is observed, indicating that HTTPS is not enforced. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, reflecting at least one independent confidence signal of malicious intent. VirusTotal records indicate that the domain was examined by 95 scanning engines, none of which raised a detection; however, the absence of detections does not constitute evidence of safety.

The nameservers fay.ns.cloudflare.com and null oswald.ns.cloudflare.com are typical of Cloudflare‑hosted services, which can obscure the true origin of the hosting infrastructure. The only classified threat category attached to the domain is “Crypto Scam”, consistent with the broader “crypto drainer” pattern where victims are induced to transfer cryptocurrency to attacker‑controlled wallets. The domain’s current status is offline, limiting immediate observation of payload delivery or victim interaction.

Defenders should treat claim-syrupfi.co as a high‑confidence indicator of a crypto‑draining operation: block the domain at perimeter firewalls, add it to internal threat intelligence feeds, and monitor DNS logs for any resolution attempts. Because the site lacks TLS, any attempted connections would be unencrypted, offering an additional detection surface. Continuous profiling of the associated IP address and its Cloudflare ASN is advised, as attackers may repurpose the same infrastructure for future campaigns.