claim-netx[.]world

Analysis of the domain claim-netx.world indicates it was a confirmed crypto drainer phishing site, operational until recently taken offline. The domain resolved to IP address 172.67.223.78, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with nameservers mario.ns.cloudflare.com and piper.ns.cloudflare.com, consistent with common phishing hosting patterns leveraging Cloudflare's services to obscure origin and evade detection. The domain was flagged by one security vendor on VirusTotal, though the specific detection context remains limited.

It appeared on a single security blocklist, classified explicitly as a crypto scam. The page title 'Nur einen Moment…' suggests a transient or redirecting page, potentially part of an evasion tactic to delay or mislead automated analysis tools. No SSL certificate was present, which is atypical for legitimate financial or crypto-related sites but not uncommon in phishing infrastructure prioritizing rapid deployment over security. Defenders should note that while the domain is currently offline, the underlying infrastructure (Cloudflare IP and nameservers) may be reused for future phishing campaigns.

The absence of SSL and the use of Cloudflare hosting are not definitive indicators of malicious activity on their own but, combined with the blocklist classification and detection by PhishDestroy, provide sufficient evidence to treat this domain as confirmed malicious. Organizations are advised to block the domain at the DNS level and monitor associated IP ranges for similar activity. The exact target or methodology of the crypto drainer remains unconfirmed due to the lack of detailed page analysis, but the classification as a crypto scam aligns with known patterns of wallet-draining attacks.