claims[.]ftx[.]click

Analysis indicates that the domain claims.ftx.click was registered through Dynadot LLC on 2025-08-03. The authoritative name servers are jade.ns.cloudflare.com and major.ns.cloudflare.com, both operated by Cloudflare, suggesting the domain leverages Cloudflare’s DNS infrastructure. DNS resolution points to the address 198.18.68.169, which is associated with a Vercel hosting environment that presents HTTP Strict Transport Security headers. An HTTPS endpoint is secured with a Let’s Encrypt certificate (R13) and responds with HTTP status 451, indicating the request is blocked for legal reasons.

The page title returned by the server is "Deployment Unavailable", a generic placeholder rather than a brand‑specific landing page. Two of ninety‑five VirusTotal scanners have flagged the domain, and the domain currently appears on two public blocklists. Independent phishing‑filter services PhishDestroy and ScamSniffer list the domain as malicious and categorize it as a crypto‑drainer scam. The combination of a recent creation date, Cloudflare DNS, Vercel hosting, HSTS enforcement, and the "Deployment Unavailable" title is consistent with infrastructure used by actors that host temporary drop‑sites for cryptocurrency‑draining campaigns.

Because the site is presently offline, active network interaction cannot be observed, leaving the exact phishing payload or wallet addresses unknown. Defenders should continue to block the domain at the DNS and proxy layers, monitor the IP address 198.18.68.169 for any re‑use, and add the domain to internal blocklists. Additional scrutiny of any future TLS certificates issued for this name is recommended, as is periodic re‑scanning with multi‑engine services to detect any changes in detection scores.