claim[.]switchfoundation[.]xyz

The domain claim.switchfoundation.xyz was observed to resolve to the IP address 172.67.139.151, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain uses Cloudflare’s authoritative nameservers arturo.ns.cloudflare.com and ophelia.ns.cloudflare.com. Registration data indicates the domain was created on September 09, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. No TLS certificate is presented, meaning the site operates without HTTPS protection.

The page title returned from the live endpoint, before it was taken offline, is "$SWTCH Airdrop Claim", and the infrastructure has been classified as employing an “Airdrop Scam” phishing kit. Gridinsoft’s trust scoring assigns a value of 0 out of 100, reflecting a high confidence of malicious intent. The domain is listed on two security blocklists—PhishDestroy and ScamSniffer—and VirusTotal reports that two of ninety‑five scanning engines flagged the domain, supporting the classification of a wallet/seed phishing campaign targeting the brand “across”.

The risk level is marked as elevated, and the current operational status is offline. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration attempts, and consider adding the domain to internal deny lists. Additional observation of any future DNS changes or TLS acquisition would be required to reassess the threat posture.