claims-now[.]com

The domain claims-now.com was registered on 21 February 2026 and is currently taken offline. Automated scans show that the site presented a page titled “Claim | Lab”, which aligns with a reported crypto scam. The domain is associated with a Cloudflare‑hosted IP address 172.67.152.76 located in the United States under ASN 13335. SSL certificate identified as “WE1” was observed, indicating a valid TLS layer but offering no indication of legitimacy.

Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100, both suggesting a high likelihood of malicious activity. The site is listed on two known phishing blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal analysis recorded nine detections out of ninety‑five scanners, confirming that multiple security vendors consider the domain malicious. The campaign explicitly targets the Metamask brand, classifying the activity as a “Crypto Scam”.

No further technical artefacts such as redirect chains, script kits, or payloads have been disclosed. Consequently, defenders should continue to block claims-now.com at network perimeter, monitor outbound connections to the Cloudflare IP range for related activity, and flag any authentication attempts that reference Metamask credentials originating from this domain. Ongoing observation is recommended to capture any re‑appearance or infrastructure changes, as current evidence is limited to the listed indicators.