claimfreeboxgames[.]world

The domain claimfreeboxgames.world was observed delivering a crypto‑drainer campaign. Infrastructure analysis shows the domain resolves to the Cloudflare‑owned address 172.67.129.90, which is associated with AS13335 Cloudflare, Inc. and geolocated to the United States. The authoritative name servers ezra.ns.cloudflare.com and keyla.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network, and the TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS termination despite the malicious intent. VirusTotal scans have recorded five positive detections out of ninety‑one submitted engines, and the domain is listed on a single external blocklist. Additional reputation data includes a Gridinsoft trust score of zero out of one hundred, reflecting an extremely low confidence rating.

The HTTP response returned a 403 status code at the time of collection, and the page title reported by the crawler was “Just a moment…”, which is typical of Cloudflare challenge pages rather than a user‑facing login portal. No further content was captured before the site was taken offline. Registration data indicates the domain was registered through NameSilo, LLC, a registrar frequently used by malicious actors, but no WHOIS privacy or additional contact details were disclosed in the provided intelligence. The domain has been flagged by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken remediation action.

Because the site is no longer reachable and only a challenge page was observed, the exact payload delivery mechanism, targeted cryptocurrency wallets, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to block the IP address 172.67.129.90 and the domain claimfreeboxgames.