usd1-claims[.]com

Analysis of the domain usd1-claims.com reveals infrastructure consistent with a crypto drainer scam, as classified by available threat intelligence. The domain was registered on February 21, 2026, and currently resolves to the IP address 172.67.220.41, which is associated with Cloudflare, Inc. (AS13335) in the United States. The SSL certificate is issued by WE1, a provider commonly observed in both legitimate and malicious traffic due to Cloudflare's proxy services. At the time of assessment, the domain is offline, though its prior activity triggered detections from five of ninety-three security vendors on VirusTotal, alongside a listing on one security blocklist.

The page title, 'Just a moment...', is a default placeholder often seen when Cloudflare's anti-bot mechanisms are active or when a site is in a transitional state, though it does not confirm the exact nature of the content served. Infrastructure analysis indicates the domain was likely designed to target cryptocurrency users, aligning with the 'Crypto Scam' classification in available intelligence. The use of Cloudflare's network may have been intended to obscure the true hosting origin and evade basic IP-based blocking. While the domain is no longer accessible, its prior detection by security vendors and presence on a blocklist suggest it was operational long enough to pose a risk.

Defenders should treat any residual DNS records or cached references to this domain as potentially malicious. Organizations are advised to review logs for connections to 172.67.220.41 or the domain itself, particularly in contexts involving cryptocurrency transactions or wallet interactions. Further investigation into the registrar and historical DNS records may provide additional indicators of compromise, though no registrar details are currently available in the supplied evidence.