claim[.]gweiportal[.]click

The domain claim.gweiportal.click was registered on May 27 2026 through Dynadot, LLC. DNS resolution points to 104.21.1.175, a Cloudflare address located in Canada. The authoritative nameservers are george.ns.cloudflare.com and raina.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. The site presents a valid Let’s Encrypt certificate (E8) and responds with an HTTP 301 status, redirecting visitors to a target page whose title is "Cryptocurrency prices, Token rates and Altcoin charts ranked by Market Capitalization and Volume | CryptoRank.io". The page title suggests an attempt to masquerade as a legitimate cryptocurrency market data site, consistent with the classified crypto drainer threat. Reputation scoring from Gridinsoft is 0/100, and the domain is listed on at least one public blocklist, including PhishDestroy. VirusTotal records indicate that one of 91 scanning engines has flagged the domain, though the specific detection is not disclosed. The combination of recent registration, Cloudflare front‑end, low trust score, and the presence of a redirect to a crypto‑related page aligns with known crypto‑drainer campaigns that aim to harvest wallet credentials or redirect victims to malicious payment pages. At present, no additional infrastructure such as command‑and‑control servers or payload hashes has been observed. Defenders should block DNS resolution for claim.gweiportal.click, monitor outbound connections to the associated Cloudflare IP, and consider adding the domain to internal URL filtering lists. Continuous re‑assessment is recommended as further intelligence, such as malicious payload delivery or victim reports, may emerge.