claimtondaily[.]pages[.]dev

Analysis indicates that the domain claimtondaily.pages.dev is currently offline but was previously serving a page titled “Suspected phishing site | Cloudflare”. The domain resolves to 188.114.96.3, an IP address owned by Cloudflare, Inc. (AS13335) located in the United States. Registration was performed through Cloudflare on September 2, 2020, using Cloudflare’s default nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com. The site employed HTTPS with a certificate issued by Google Trust Services under the WE1 root, and HTTP/3 with HSTS enabled, confirming the presence of modern security headers. Threat intelligence sources have classified the site as a crypto‑drainer scam.

It appears on two independent blocklists – PhishDestroy and ScamSniffer – and has been flagged by 10 of 93 security vendors on VirusTotal. Reputation services assign extremely low trust scores: Gridinsoft 0/100 and Scamadviser 11/100. The HTTP response returned a 403 status code, indicating that access to the content is denied, which is consistent with the domain being taken offline at the time of analysis. While the exact payload or victim‑interaction flow has not been publicly disclosed, the combination of a Cloudflare‑hosted IP, a recent SSL certificate, and the presence on multiple anti‑phishing lists strongly suggests a deliberate attempt to lure cryptocurrency users into transferring assets to an attacker‑controlled wallet.

No additional indicators such as malicious scripts, command‑and‑control endpoints, or compromised infrastructure have been observed. Defenders should block DNS resolution for claimtondaily.pages.dev and any sub‑domains, enforce outbound traffic filtering to the associated IP address (188.114.96.3) and monitor for attempts to contact Cloudflare‑served endpoints that match the same certificate fingerprint.