claimika[.]xyz

On July 22, 2026, claimika.xyz was observed as an offline cryptocurrency‑drainer infrastructure. The domain was registered on July 17, 2025 through NameSilo, LLC and is hosted on Cloudflare’s network (AS13335) with the address 172.67.148.167 located in the United States. No TLS certificate is presented for the host, indicating that HTTPS was not configured at the time of analysis. The authoritative name servers are benedict.ns.cloudflare.com and carrera.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. Public threat‑intel platforms have listed the domain on two security blocklists, and it is actively blocked by the PhishDestroy and ScamSniffer filtering services.

VirusTotal records show that two of ninety‑five AV engines flagged the domain, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, confirming the high‑risk nature of the site. The page title returned by the HTTP response is “Ika”, which does not disclose a legitimate brand or service and is consistent with a generic crypto‑scam landing page. The available data confirms that claimika.xyz is associated with a crypto‑drainer scam, but no further technical artifacts such as malicious payload hashes, command‑and‑control endpoints, or phishing kit identifiers have been disclosed. Consequently, the full scope of the campaign—its victim targeting, payment addresses, and potential ties to other infrastructure—remains uncertain.

Defenders should continue to enforce blocklisting of the domain and its resolving IP address across perimeter and endpoint controls. Monitoring of the Cloudflare ASN for new sub‑domains or similar naming patterns is recommended, as attackers often reuse the same hosting provider. Because the domain lacks an SSL certificate, any future re‑activation would likely be detectable through TLS fingerprinting.