claimhelp[.]digital

Analysis of claimhelp.digital indicates this domain was actively used as a crypto drainer, a threat type designed to siphon cryptocurrency from victims' wallets. The domain was registered on June 2, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline as of the report date. Infrastructure analysis reveals Cloudflare-hosted nameservers (angela.ns.cloudflare.com, rayden.ns.cloudflare.com) and resolution to IP 104.21.75.137 (AS13335, Cloudflare, Inc.), a common pattern for malicious domains leveraging Cloudflare's proxy services to obscure origin servers. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious intent but is consistent with many phishing domains using valid certificates to appear legitimate.

Security vendor detections on VirusTotal show 5 of 91 engines flagging the domain, a modest but notable detection rate that aligns with crypto drainer activity. The domain appears on at least one security blocklist and is blocked by PhishDestroy, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment. No specific brand impersonation or page content details are available in the current intelligence, so the exact lures or wallet interaction methods remain unconfirmed.

Defenders should treat this domain as confirmed malicious and prioritize blocking it at the DNS, proxy, and endpoint levels. Given the crypto drainer classification, incident responders should check for connections to this domain in network logs, particularly from systems with cryptocurrency wallet software. The domain's offline status suggests possible takedown or abandonment, but defenders should monitor for re-emergence under the same or similar infrastructure. No additional IOCs (e.g.