95003005-c0db-4f49-adc4-ec50ceb5bd6c[.]claim-graphtoken[.]org

Analysis of the domain 95003005-c0db-4f49-adc4-ec50ceb5bd6c.claim-graphtoken.org indicates it was part of a crypto drainer operation targeting users under the pretext of a token claim. The domain, registered on September 22, 2024, through Dynadot LLC, resolved to IP address 75.2.18.233, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net were associated with the domain, which lacked an SSL certificate at the time of assessment. The page title, 'claim-graphtoken.org,' suggests an attempt to deceive users into interacting with a fraudulent token distribution scheme.

As of July 24, 2026, the domain has been taken offline, though it was previously flagged by four of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The domain was classified as a crypto scam, aligning with the broader pattern of drainer infrastructure designed to siphon cryptocurrency from victims' wallets. While the exact mechanics of the drainer are not detailed in available intelligence, the combination of a unique subdomain, absence of SSL, and hosting on a major cloud provider is consistent with ephemeral phishing infrastructure. Defenders should treat this domain as part of a larger campaign, particularly if linked to prior 'claim-graphtoken' activity.

Monitoring for similar subdomain patterns (e.g., UUID-style prefixes) under the claim-graphtoken.org parent domain may help identify resurfaced infrastructure. Network-level blocking of the resolved IP (75.2.18.233) and associated nameservers could mitigate residual risk, though attackers frequently rotate hosting providers. No evidence suggests this domain was part of a broader kit or branded impersonation beyond the token claim theme.