claims-zinc[.]cash

This domain, claims-zinc.cash, is confirmed as an active crypto drainer phishing site targeting cryptocurrency users. Registered on July 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure, as indicated by its nameservers (kip.ns.cloudflare.com and meera.ns.cloudflare.com). The domain is currently flagged by one security blocklist and is blocked by PhishDestroy, signaling its malicious intent. Analysis of detection data reveals that one of 91 security vendors on VirusTotal has flagged this domain, though the specific detection context remains limited.

The domain remains active as of July 27, 2026, with no indications of takedown or mitigation efforts. Defenders should treat this domain as high-risk infrastructure. The use of Cloudflare nameservers is consistent with threat actors leveraging CDN services to obscure hosting origins and evade IP-based blocking. While the exact content of the site has not been analyzed, the classification as a crypto drainer suggests it is designed to trick users into connecting wallets or authorizing transactions that result in unauthorized fund transfers.

The domain's recent registration and immediate malicious activity indicate a likely short-lived campaign, a common tactic to avoid detection and takedown. Organizations should prioritize blocking this domain at the DNS and proxy levels, and monitor for related indicators of compromise, such as wallet addresses or additional domains registered through the same registrar. Further investigation into the IP address 188.114.97.3 may reveal additional associated malicious domains or infrastructure.