cashcat-claim[.]xyz

The domain cashcat-claim.xyz is currently observed as part of an active crypto‑drainer campaign. Infrastructure analysis shows that the domain resolves to the IP address 104.21.45.214. The same IP has been flagged by multiple independent blocklist operators, including PhishDestroy, MetaMask, and SEAL, and the domain appears on three additional security blocklists. VirusTotal records indicate that the domain was submitted for scanning and examined by 91 antivirus or URL‑reputation vendors; none of the vendors generated a detection at the time of analysis.

Although the absence of a vendor flag does not constitute proof of benign intent, it does demonstrate that the domain has not yet triggered automated signatures in those services. Publicly available intelligence does not include details such as SSL certificate metadata, HTTP response codes, page title, or any reference to a specific brand or kit, so the exact content served by the site remains unverified. The lack of a published page title or brand reference means that defenders cannot rely on content‑based indicators to identify the site in network traffic. The primary observable indicators are the domain name, its DNS resolution to 104.21.45.214, and its presence on the listed blocklists.

Given the active status and the classification as a crypto drainer, defenders should treat any traffic to or from cashcat-claim.xyz as suspicious. Recommended actions include adding the domain and its IP address to local deny lists, ensuring that web filtering solutions ingest the blocklist entries from PhishDestroy, MetaMask, and SEAL, and monitoring DNS logs for resolution attempts. Organizations that employ cryptocurrency wallets should reinforce transaction‑validation controls and consider whitelisting only known, trusted wallet endpoints. Continuous re‑evaluation is advised, as future scans or additional telemetry may modify the risk posture.