pgnclaim[.]xyz

This domain, pgnclaim.xyz, is confirmed as an active crypto drainer threat, flagged by 2 out of 95 security vendors on VirusTotal and appearing on one security blocklist. The domain was registered on April 17, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and is currently hosted on Cloudflare infrastructure, resolving to IP address 104.21.12.27 located in Canada. The SSL certificate is issued by Let's Encrypt (E7), and the page title displayed is 'Just a moment...', which is often used by sites employing anti-bot mechanisms to obscure malicious content from automated scanners. The HTTP status code returned is 403, indicating restricted access, a common tactic for crypto drainer sites to evade initial detection. The domain has a Gridinsoft trust score of 0 out of 100, reflecting a high risk assessment, and is blocked by PhishDestroy. AlienVault OTX contains one threat intelligence pulse referencing this domain, further corroborating its malicious association. Infrastructure analysis reveals the use of Cloudflare nameservers (merlin.ns.cloudflare.com and nia.ns.cloudflare.com), which provides CDN and DDoS protection, complicating takedown efforts. The domain remains active as of July 12, 2026, and the exact crypto drainer kit or brand has not been identified. Defenders should block all traffic to pgnclaim.xyz and its associated IP 104.21.12.27 at network perimeter controls, add the domain to DNS sinkholes, and monitor for any subdomains or related infrastructure using the same nameservers or registration patterns. Users who may have visited the site should be advised to revoke any crypto wallet permissions and check for unauthorized transactions. The low vendor detection rate (2/95) suggests that many security products have not yet incorporated this domain into their threat feeds, making proactive blocking essential.