claim-bae[.]xyz

This analysis documents the infrastructure and observable characteristics of claim-bae.xyz, which was observed as a crypto‑drainer scam. The domain was created on 21 February 2026 through OwnRegistrar, Inc. and presently resolves to the IP address 104.21.112.1, an endpoint belonging to AS13335 Cloudflare, Inc. located in the United States. Cloudflare’s DNS service is in use, as indicated by the authoritative nameservers lily.ns.cloudflare.com and mitch.ns.cloudflare.com, and the site was observed serving HTTP/3 traffic. An HTTPS connection presented a certificate issued by Google Trust Services under the “WE1” label, confirming the use of a valid TLS chain. The sole page retrieved returned HTTP 403 and displayed the title “Site is created successfully!”.

While the title does not reveal a phishing replica, it is consistent with a confirmation page commonly employed by crypto‑drainer campaigns to suggest successful account setup. Reputation data show the domain appears on a single blocklist, PhishDestroy, and has been flagged by seven of ninety‑three VirusTotal scanners, reflecting a moderate level of external consensus on malicious intent. The Gridinsoft trust score of zero further underscores the high risk assessment. The overall risk level is listed as elevated, and the campaign status is recorded as taken offline. Uncertainties remain regarding the exact payload delivered, the cryptocurrency addresses used for extraction, and the victim profile, as the site is no longer reachable for deeper content inspection.

No additional intelligence such as phishing kits or targeted brand references is available. Defenders should immediately block claim-bae.xyz and its associated IP 104.21.112.1 at network perimeter and DNS layers. Monitoring for future domains that resolve to the same Cloudflare IP range or that present similar HTTP‑403 responses with the same page title is advisable.