# PhishDestroy threat dossier — claimx.xyz ================================================================ Fetched: 2026-05-02 05:07:51 UTC Canonical: https://phishdestroy.io/domain/claimx.xyz/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 78/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain URLQuery: 3 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 94.103.1.174 (NL, Amsterdam) ASN: AS209207 Digital Hosting Provider LLC Hosting org: Digital Hosting Provider LLC Registrar: Dynadot LLC Nameservers: ns1.dyna-ns.net, ns2.dyna-ns.net Registered: 2026-05-01 Page title: Check Your Eligibility HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-07-30 Status: INVALID chain Fingerprint: 09293867ca4c25ed6dc86a626e044872d5c5d96887abb031e634c6e2c661bf53 Subject Alternative Names (related infrastructure — often same operator): - www.claimx.xyz ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-01 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-02 00:36:11 UTC (by PhishDestroy tracker) First reported: 2026-05-01 21:36:59 UTC (abuse notice filed) Last verified: 2026-05-02 07:40:02 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019de576-97ab-72ab-a2f3-b1fff15c3c5b/ URLQuery: https://urlquery.net/report/d04256e4-5bd1-42ad-aac0-5bb9959842ff Wayback Machine: https://web.archive.org/web/*/claimx.xyz crt.sh CT logs: https://crt.sh/?q=%25.claimx.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=claimx.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/claimx.xyz URLhaus: https://urlhaus.abuse.ch/host/claimx.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-02 00:37:09 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies claimx.xyz as an active crypto drainer domain currently under investigation due to its engagement in malicious cryptocurrency theft operations. The site leverages deceptive tactics to trick users into authorizing unauthorized token transfers, posing a severe financial threat to unsuspecting visitors. Threat intelligence confirms this domain is designed with a singular focus: draining cryptocurrency wallets through fraudulent transaction approvals. This domain was flagged with a crypto_drainer type threat, exhibiting multiple red flags across key security indicators. VirusTotal scans show 0/95 detections at the time of analysis, indicating it remains undetected by most antivirus engines despite its malicious operations. Registered through Dynadot LLC, the domain resolves to IP address 94.103.1.174 and utilizes a Let's Encrypt SSL certificate for HTTPS encryption, which does not imply legitimacy. The domain was created on May 01, 2026, suggesting it is a recently deployed threat infrastructure designed for quick deployment and evasion. While there are no confirmed listings on major blocklists at this stage, its zero detection rate and active operation status warrant immediate caution. Given the confirmed role of claimx.xyz as a crypto drainer, users must treat this domain as actively hostile and avoid any interaction. If you have previously visited or connected your wallet to this site, revoke any unauthorized token approvals immediately using tools like Etherscan’s Token Approval Checker or your wallet’s built-in approval management. Never approve transactions or sign messages from unknown domains, especially those claiming to offer rewards or claim processes. Use hardware wallets or non-custodial solutions with strict transaction confirmation to prevent unauthorized transfers. Report this domain to relevant authorities such as Google Safe Browsing, PhishTank, or your local cybercrime unit to aid in broader detection efforts. Monitor wallet activity for suspicious outbound transfers and consider using wallet guards or firewall extensions that block known malicious domains. Staying vigilant and verifying every interaction with blockchain platforms can prevent irreversible financial loss. [Updates since narrative was generated:] - VirusTotal detections: now 7/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260501-709AED Favicon MD5: 6b0c3a937095705c09335887d2269e9d TLS cert SHA-256: 09293867ca4c25ed6dc86a626e044872d5c5d96887abb031e634c6e2c661bf53 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/claimx.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=claimx.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io