spacepayclaim[.]top

Analysis of the domain spacepayclaim.top indicates active involvement in a crypto drainer phishing campaign, classified as high-risk based on infrastructure and detection data. The domain was registered on February 21, 2026, through Openprovider, a registrar frequently associated with malicious activity. It currently resolves to the IP address 172.236.104.157, hosted by Akamai Technologies, Inc. in the United States. While Akamai is a legitimate content delivery network, the IP has been linked to confirmed phishing operations, though no direct attribution to a specific threat actor or group is available at this time. The domain is configured with nameservers ns1.domainregistrar.biz, ns2.domainregistrar.biz, and ns3.domainregistrar.biz, a pattern observed in other fraudulent domains leveraging the same DNS infrastructure.

A Let's Encrypt SSL certificate (YE1) is present, providing HTTPS encryption, which is commonly exploited by threat actors to lend a false sense of legitimacy to phishing sites. The HTTP status returns a 200 code, and the page title displays 'Redirecting...', suggesting the domain may serve as an intermediary in a multi-stage attack chain, potentially redirecting victims to a secondary malicious endpoint. Detection data from security vendors indicates moderate but concerning visibility. As of the latest scan, 11 out of 95 security vendors on VirusTotal flag the domain as malicious, with classifications aligning to crypto scams. The domain appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, which specialize in cryptocurrency-related fraud detection.

Gridinsoft assigns a trust score of 0/100, reinforcing the assessment of high risk. The exact content and functionality of the domain remain unconfirmed, as no forensic analysis of the page has been conducted.