funclaimnow[.]xyz

The domain funclaimnow.xyz was registered on September 27 2025 via NameCheap, Inc. It resolves to the IPv6 address 2606:4700:3031::6815:4bad, which is advertised by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain currently returns no SSL certificate, indicating that connections are unencrypted. The site is listed as offline at the time of analysis on July 25 2026. The page title observed during a brief fetch attempt was “Verification”, and the content is reported to masquerade as a Coinbase‑branded airdrop, fitting the “Fake Airdrop” scam type.

The domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer, confirming that security‑focused feeds have flagged it. VirusTotal analysis shows that nine of ninety‑five scanning engines flagged the domain, reinforcing the malicious classification. The Gridinsoft trust score of 0 out of 100 further reflects a lack of reputational credibility. No TLS certificate, low trust score, and blocklist presence suggest that the infrastructure was deliberately provisioned to host a short‑lived impersonation campaign rather than a legitimate service.

The absence of additional public intelligence, such as Safe Browsing or OTX entries, leaves the broader campaign scope uncertain; however, the combination of brand impersonation, a verified page title, and active blocklist listings provides sufficient confidence to treat the domain as malicious. Defenders should block any outbound connections to funclaimnow.xyz at the DNS and network layers, add the IPv6 address to firewall deny lists, and monitor for similar domains that resolve to Cloudflare‑hosted IPv6 ranges with no TLS. Incident response teams encountering user reports of unexpected Coinbase airdrop notifications should advise users to disregard the request and to report the incident to their internal security channels.