claim-cherryai[.]xyz

This domain, claim-cherryai.xyz, was registered on August 14, 2025 through Web Commerce Communications Limited and is currently marked as offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., placing the hosting location in the United States. Both authoritative name servers are hosted on Cloudflare (rosalyn.ns.cloudflare.com and shane.ns.cloudflare.com). No TLS certificate is presented, indicating that HTTPS connections would be unencrypted if the site were reachable. The page title returned by the last known HTTP response is “Human Verification”, a generic label often used in credential‑harvesting flows.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 11 of 95 scanned security vendors flagged the domain as malicious. The domain appears on a single external security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. PhishDestroy has already blocked the domain, and the overall threat category is listed as a crypto scam, specifically a crypto drainer. While the site is taken offline, the observed indicators suggest that the domain was actively used to lure victims into providing cryptocurrency wallet credentials or to initiate unauthorized transfers.

Defenders should ensure that the IP address 188.114.96.3 is added to firewall deny lists and that DNS resolvers block claim‑cherryai.xyz. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advisable, as the same infrastructure can be repurposed for new malicious domains. Endpoint protection policies should be updated to treat any attempt to access this domain as a high‑severity event, and security teams should audit logs for prior connections to the domain or its IP to identify potential compromise.