verticalstudio-claims[.]xyz

verticalstudio-claims.xyz was first observed on July 12, 2026 and is classified as a high‑risk cryptocurrency drainer. The domain is actively serving content and has been flagged by multiple security feeds. Its risk rating is high and it remains on the active watchlist. The domain was registered on November 03, 2025 through NameSilo, LLC and uses the Cloudflare nameservers ines.ns.cloudflare.com and sam.ns.cloudflare.com. DNS resolution points to IP address 172.67.154.37, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint. HTTP requests return a 403 status code, and the only observed page title is “Un momento…”. VirusTotal analysis shows that 3 of 95 scanned security vendors have flagged the domain, and the site appears on one external blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already blocked the domain. Detected technologies include Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. Publicly available information does not reveal the exact landing page content beyond the title, nor the specific payload used to drain cryptocurrency wallets. The limited detection by VirusTotal suggests that many scanners have not yet identified malicious behavior, which may indicate a low‑profile or evolving campaign. Defenders should add verticalstudio-claims.xyz to network and endpoint blocklists, monitor DNS queries for the domain, and enforce TLS inspection to capture any hidden payloads. Continuous re‑scanning with updated vendor engines is advised, as additional indicators may emerge. Organizations handling cryptocurrency transactions should treat any interaction with this domain as a breach attempt and isolate compromised assets immediately.