claimgetcookierewards[.]xyz

Analysis of claimgetcookierewards.xyz indicates a confirmed crypto drainer operation, classified as an elevated-risk threat. The domain was registered on August 31, 2025, through NiceNIC International Group Co., Limited, and is currently offline as of the report date. Infrastructure analysis reveals resolution to IP 104.21.112.1, hosted on Cloudflare's network (AS13335) in the United States, with nameservers barbara.ns.cloudflare.com and sullivan.ns.cloudflare.com. No SSL certificate is present, increasing the likelihood of unencrypted malicious activity. Detection data shows limited but targeted flagging: PhishDestroy has blocked the domain, and it appears on one security blocklist.

VirusTotal reports 4 of 95 security vendors marking it as malicious, though the absence of broader detection does not imply safety. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, suggesting the domain may have been configured to evade immediate detection or was caught in a transitional state. Defenders should treat this domain as part of a crypto drainer campaign.

The lack of SSL, Cloudflare hosting, and minimal detection at the time of reporting are typical of short-lived malicious infrastructure. Blocklist the domain and associated IP 104.21.112.1 at perimeter defenses. Monitor for related domains registered through the same registrar or resolving to Cloudflare IPs, as this pattern is common in crypto scam operations. No brand or specific scam variant beyond 'crypto scam' is confirmed in the available data, so avoid assumptions about targeting until further evidence emerges.