# claim-resolv.app — SUSPICIOUS

> claim-resolv.app is a recently activated crypto-drainer domain registered on March 22, 2026, resolving to 172.67.166.48 with 0/95 VirusTotal detections.

## Summary
PhishDestroy identifies claim-resolv.app as an active crypto-drainer domain currently under forensic review. The threat involves the exfiltration of cryptocurrency wallet credentials and private keys through deceptive web interfaces mimicking legitimate claim portals. This domain has not yet been linked to a specific drainer kit variant in public databases, but operational patterns suggest integration with turnkey drainer-as-a-service toolkits commonly advertised in underground forums. No known affiliation with established brands has been confirmed at this stage, indicating a likely opportunistic campaign rather than a targeted brand impersonation.


Technical indicators place this domain at high risk despite its current lack of antivirus detection. claim-resolv.app was registered on March 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolving to IP address 172.67.166.48. VirusTotal scanning returned 0/95 detections as of last update, indicating zero detection by major security vendors. The domain holds a valid Let's Encrypt SSL certificate, increasing user trust while facilitating encrypted exfiltration of stolen data. Searches across public blocklists show no prior inclusion, suggesting a newly deployed infrastructure. The combination of fresh registration, unflagged status, and real-time IP resolution points to a rapidly evolving threat with minimal historical tracking.


This domain remains under active investigation with a status of 'active' and a risk level categorized as 'under_investigation.' No official blocklist inclusion has been issued by Google Safe Browsing or other major threat intelligence platforms. Users are strongly advised to avoid any interaction with claim-resolv.app or associated URLs. Security teams should monitor network traffic for connections to 172.67.166.48 and inspect SSL certificates associated with recently registered .app domains. Remaining risk is elevated due to undetected status and likely deployment in live campaigns. Immediate reporting to threat intelligence platforms and local CERTs is recommended to accelerate detection coverage and prevent further victimization.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-22 13:23:38
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.166.48

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/ff949f92-976b-4202-8698-6a0adcdd5016
- PhishDestroy: https://phishdestroy.io/domain/claim-resolv.app/
- LLM endpoint: https://phishdestroy.io/domain/claim-resolv.app/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/claim-resolv.app/
Last updated: 2026-03-24