claim[.]subquery[.]foundation

The domain claim.subquery.foundation has been identified as a brand impersonation threat, specifically targeting users of the SubQuery Network with a fraudulent airdrop scheme. This phishing campaign aims to trick victims into connecting their wallets or sharing sensitive information under the guise of an airdrop reward. The page title, 'SubQuery Network Airdrop,' is a common lure used by crypto drainers to steal digital assets. No specific drainer kit has been attributed, but the method aligns with typical airdrop scams that request wallet signing or seed phrases.

Technical analysis reveals that the domain was created on February 21, 2026, and registered through Amazon Registrar, Inc. It resolves to IP address 108.138.26.78 and uses an SSL certificate issued by Amazon with the subject Amazon RSA 2048 M03. VirusTotal shows 0 detections out of 95 scans, indicating that the domain had not been flagged by security vendors prior to its takedown. However, it appears on one security blocklist, suggesting some prior identification as malicious. The domain is currently offline, meaning the hosting has been suspended or taken down, likely due to user reports or automated detection by security services.

PhishDestroy has flagged this domain as under investigation and has taken steps to warn users. The current status is offline, which reduces immediate risk, but the domain could potentially be reactivated or moved to a different IP. Users who may have interacted with the site should be vigilant for follow-up phishing attempts. It is strongly recommended to never connect wallets or provide personal information on unsolicited airdrop sites. Always verify official airdrop announcements through the project's verified channels. For ongoing protection, use PhishDestroy's blacklist and report any similar suspicious domains.