claim-mitosis[.]live

This domain, claim-mitosis.live, is actively flagged as part of a cryptocurrency drainer operation. Infrastructure analysis reveals it is hosted behind Cloudflare (AS13335) and resolves to 104.21.16.1, a US-based IP address. The domain is currently returning an HTTP 403 status with the page title 'Nur einen Moment…', suggesting either a holding page or a Cloudflare interstitial. It appears on one security blocklist and is detected by 5 of 95 vendors in a recent scan, though the exact nature of these detections is not specified. The domain was registered through a reseller associated with PublicDomainRegistry.com and uses Cloudflare nameservers (zod.ns.cloudflare.com, june.ns.cloudflare.com). SSL inspection shows a valid Cloudflare-issued certificate, which does not indicate compromise but does obscure the origin server details. Defenders should note that the domain remains active and is classified as a high-risk crypto drainer threat. The lack of additional infrastructure details—such as backend hosting, associated wallets, or specific attack patterns—limits further attribution. However, the combination of Cloudflare proxying, the HTTP 403 response, and the page title may indicate an attempt to evade automated detection while maintaining operational readiness. Network-level blocking of the resolved IP (104.21.16.1) and monitoring for related domains using the same nameservers or registration patterns is recommended. Given the active status and confirmed scam classification, this domain should be treated as hostile until further evidence suggests otherwise.