claim[.]reward-billonsol[.]xyz

Analysis of the domain claim.reward-billonsol.xyz confirms its classification as a crypto drainer scam, operational since February 27, 2026. The domain was registered through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. Cloudflare nameservers (aiden.ns.cloudflare.com and magdalena.ns.cloudflare.com) are configured for DNS resolution, a common pattern observed in phishing infrastructure leveraging Cloudflare's proxy services to obscure backend hosting details. The domain is flagged on one security blocklist, and four of ninety-three security vendors on VirusTotal detect it as malicious, aligning with its designation as a crypto scam.

The absence of an SSL certificate further reduces its legitimacy, as modern phishing sites typically employ HTTPS to evade browser warnings. The page title, 'Just a moment...', suggests the site may have been caught in a Cloudflare interstitial or proxy verification step, which is often used to filter automated analysis tools or delay access to malicious content. Infrastructure analysis reveals the domain was taken offline by July 24, 2026, though historical records indicate it was active long enough to pose a risk.

Defenders should treat this domain as part of a broader crypto drainer campaign, particularly given its thematic structure (e.g., 'reward-billonsol') designed to lure victims with false cryptocurrency incentives. Network-level blocking of the IP 188.114.96.3 and monitoring for related subdomains under reward-billonsol.xyz are recommended. While the exact content of the site remains unanalyzed, the available evidence—registration details, detection counts, and hosting patterns—supports its classification as a confirmed malicious domain targeting cryptocurrency users.