claim-anyone[.]xyz

Analysis indicates that claim-anyone.xyz is an active crypto drainer infrastructure that has been taken offline as of the reporting date. The domain was registered on 13 October 2024 through OwnRegistrar, Inc. and is hosted on Cloudflare’s network (AS13335), resolving to IP address 104.21.32.1 located in the United States. The site presented the generic page title “Just a moment…”, and no SSL certificate was observed, suggesting HTTP‑only delivery. Threat intelligence classifies the site as a crypto scam, specifically a crypto drainer, and six of ninety‑five VirusTotal scanners flagged the domain as malicious.

The domain is listed on a single security blocklist and is currently blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 out of 100 and the presence of two Cloudflare nameservers (fay.ns.cloudflare.com and oswald.ns.cloudflare.com). No further evidence such as phishing kits, compromised credentials, or payload hashes has been disclosed. Uncertainties remain regarding the exact mechanisms used to exfiltrate cryptocurrency, the presence of any underlying malicious binaries, and whether the IP address is shared with unrelated legitimate services.

Because the domain is already offline, immediate traffic to the host is unlikely, but the IP may still be leveraged for other malicious operations. Defenders should continue to block the domain and its resolving IP at perimeter and DNS filtering layers, monitor for re‑registration attempts, and add the domain to internal threat intel feeds. Continuous observation of Cloudflare‑hosted IP ranges for anomalous activity is recommended, as is periodic re‑scanning with updated VirusTotal and sandbox environments to capture any new payloads if the site resurfaces.