claim-liveart[.]xyz

The domain claim-liveart.xyz was registered on September 9, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 104.21.80.1 (AS13335, United States). The site presented the page title “Nur einen Moment…”, a German phrase meaning “Just a moment…”. No TLS certificate was observed, indicating the site served HTTP only. VirusTotal scans reported that two of ninety‑five security vendors flagged the domain as malicious, and the domain appears on at least one public blocklist. PhishDestroy has also listed it as blocked. The infrastructure was tied to a crypto‑drainer scam, described in the intelligence as a “Crypto Scam”, and the current operational status is offline.

Defenders encountering traffic to claim-liveart.xyz should treat the domain as hostile. The lack of a valid SSL certificate, combined with the short registration window and the association with Cloudflare’s edge network, aligns with typical abuse‑hosted malicious infrastructure. Because the domain is already taken offline, any active connections are likely remnants of prior compromise attempts. Nevertheless, threat‑intel feeds may still reference the domain, and residual DNS records could be cached in internal resolvers. Network teams should block the domain at perimeter firewalls and DNS filters, and ensure that any endpoint alerts referencing the two VirusTotal detections are correlated with this indicator.

Incident responders should also verify that no credential or wallet information was submitted to the site before it was shut down, and consider searching logs for the page title “Nur einen Moment…” as an additional identifier. The presence on a security blocklist indicates that external reputation services already consider the host malicious, so integrating those feeds into automated blocklists will reduce exposure. Since the domain used Cloudflare’s default nameservers (noel.ns.cloudflare.com and sloan.ns.cloudflare.