claimmoney[.]ourprizepack[.]com

Analysis indicates that claimmoney.ourprizepack.com was registered on 21 February 2026 through Amazon Registrar, Inc. The domain resolves to 172.67.200.87, an address owned by AS13335 Cloudflare, Inc., placing the infrastructure within the United States. The site is protected by Cloudflare and serves a TLS certificate issued by Let’s Encrypt (E7), confirming the use of a valid, automated certificate. An HTTP request returns a 404 status, and the only visible page title is “Claim $1000”, suggesting a lure that promises a monetary reward. The threat classification provided is “Crypto Scam” with a specific focus on crypto draining, indicating that the page likely attempts to convince victims to transfer cryptocurrency to an attacker‑controlled wallet.

The domain has been taken offline, and the blocklist PhishDestroy already lists it as malicious. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious reputation. VirusTotal reports that seven of ninety‑three scanning engines flag the domain, and it appears on one external security blocklist. The presence of Cloudflare’s DNS (isaac.ns.cloudflare.com, zita.ns.cloudflare.com) does not conceal the underlying hosting, but it does provide a layer of anonymity that can impede direct takedown.

Uncertainties remain regarding the exact payload, the wallet addresses used, and whether any active command‑and‑control infrastructure existed before the takedown. Defenders should immediately block any outbound connections to 172.67.200.87 at the network perimeter, add the domain to URL filtering and DNS sinkhole lists, and monitor for any related traffic patterns that reference the “Claim $1000” lure. Incident response teams should also query internal logs for recent attempts to resolve or contact this domain, and consider updating threat‑intel feeds with the observed indicators of compromise.