claim[.]world3ai[.]xyz

Analysis of the domain claim.world3ai.xyz indicates it was actively involved in a crypto scam impersonating Binance, specifically targeting users with a fraudulent airdrop scheme. The domain was registered on February 21, 2026, and resolved to the IP address 104.21.64.1, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate was issued by WE1, a detail that may assist in identifying related infrastructure. The page title, 'Airdrop - WORLD3,' aligns with the scam type identified as an 'Airdrop Scam,' a common tactic used to deceive users into disclosing sensitive information or transferring cryptocurrency. Detection data from security vendors is limited but notable: 2 out of 93 vendors on VirusTotal flagged the domain as malicious.

Additionally, the domain appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious nature. As of the report date, the domain has been taken offline, though defenders should remain vigilant for potential re-emergence or similar domains leveraging the same tactics. Defenders are advised to review historical DNS and proxy logs for connections to 104.21.64.1 or the domain itself, particularly from systems that may have accessed cryptocurrency-related services.

The use of Cloudflare hosting is consistent with many phishing campaigns, as it provides both anonymity and resilience. While the exact content of the phishing page is not analyzed here, the combination of the page title, scam type, and impersonation of Binance suggests it was designed to exploit users expecting legitimate airdrop opportunities. No further details about the phishing kit's functionality or payload delivery are available at this time. Blocking the domain and associated IP at perimeter defenses is recommended as a precautionary measure.