claim-somnia[.]me

On July 23, 2026, claim-somnia.me was observed to host a page titled “Somnia Airdrop”. The site is currently offline, but historical evidence indicates it was used in a social‑media phishing campaign that pretended to be associated with Discord. The page title and the attribution to an “Airdrop Scam” kit suggest the operators attempted to lure Discord users with a bogus token distribution. The domain was registered on 21 February 2026 and resolves to the Cloudflare IP address 172.67.185.131, which is located in the United States and belongs to ASN 13335 (Cloudflare, Inc.). The SSL certificate presented the identifier “WE1”, confirming that TLS was active at the time of analysis.

Reputation services have flagged the domain. Scamadviser assigned a trust score of 46 / 100, while Gridinsoft reported a score of 0 / 100, indicating a high likelihood of malicious intent. VirusTotal recorded detections from 2 of 93 scanned security vendors, corroborating the suspicion. The domain appears on two public blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering engines. No additional intelligence such as OTX identifiers or registrar details were disclosed.

The limited data leaves several uncertainties: the exact content of the landing page, any credential‑stealing forms, and the persistence of the infrastructure after the takedown are not publicly available. Nonetheless, the convergence of a recent registration date, Cloudflare hosting, a low trust score, and detection by multiple security products provides a clear indicator of a compromised site targeting Discord users. Defenders should add claim-somnia.me to internal blocklists, monitor outbound DNS queries for the associated IP address, and enforce URL filtering rules that deny access to the domain and any sub‑domains resolved to the same IP.