x-claim-status[.]pages[.]dev

PhishDestroy identifies x-claim-status.pages.dev as a live crypto drainer domain suspected of harvesting private wallet keys and tokens under active fraud investigation. The domain is part of a drainer kit that masquerades as a legitimate claim-status portal, tricking victims into connecting crypto wallets and authorizing malicious transactions. Cloudflare Pages hosting and Let’s Encrypt SSL certificate are used to lower suspicion. x-claim-status.pages.dev resolves to IP 172.66.47.118 and is registered via Cloudflare, Inc. VirusTotal currently returns 0 detections out of 95 scanners as of seed 4d582c. The domain lacks entry in Google Safe Browsing (GSB) at this time. Historical blocklists report no existing coverage, indicating zero prior detections across threat intelligence platforms. This domain remains active and under fraud investigation with ‘under_investigation’ status. Users should immediately block 172.66.47.118 and x-claim-status.pages.dev at the firewall, DNS, and browser levels. Asset owners using Cloudflare Pages should review logs for this subdomain and scan connected wallets for unauthorized transactions. While current threat intel is limited, the drainer kit’s deployment model suggests increasing risk of fund theft and identity harvesting in the near term.