unclaimedfunds[.]xyz

The domain unclaimedfunds.xyz was registered on February 21, 2026 and is currently active. DNS resolution returns the IPv6 address 2600:140b:1c00:e::17cb:850f, which maps to a server located in Japan under AS20940 (Akamai International B.V.). The web service presents a 200 HTTP response with the page title "Redirecting..." and is served by Nginx/OpenResty behind a Let’s Encrypt R12 certificate. The domain appears on three security blocklists (PhishDestroy, ScamSniffer, Enkrypt) and holds a Gridinsoft trust score of 0/100. VirusTotal analysis shows that 2 of 93 scanners flag the domain, indicating some malicious characteristics. It is classified as a crypto drainer scam and assigned a high risk rating. While the exact malicious payload has not been observed, the combination of blocklist presence, low trust score, and the redirect behavior suggests it is used to lure victims into transferring cryptocurrency. Defenders should add unclaimedfunds.xyz to firewall deny lists, monitor outbound connections for attempts to resolve the IPv6 address, and apply URL filtering to block HTTP traffic to this host. Continuous monitoring of the domain’s activity and periodic re‑scanning are advised to detect any evolution of the threat.