claim-labs[.]com

The domain claim-labs.com has been identified as an active crypto drainer site, posing a high risk to potential victims. The domain was created on March 11, 2026, and is registered through HOSTINGER operations, UAB. Analysis shows that the domain resolves to IP address 84.32.84.95. It is currently active and is flagged on two security blocklists, indicating its malicious intent. The site has a low trust score of 0/100 on Gridinsoft, further confirming its dubious nature. Additionally, VirusTotal indicates that 2 out of 95 security vendors have flagged this domain, suggesting that it has been recognized as harmful by a minority of antivirus tools, which may not be comprehensive.

The page title "ClaimLab - Giveaways" suggests an attempt to lure users with enticing offers. The infrastructure employs technologies such as Node.js, React, Next.js, and Webpack, and utilizes Hostinger CDN and HTTP/3, which are commonly used for legitimate purposes but can be leveraged by malicious entities. The presence of an Airdrop Scam phishing kit indicates a targeted approach to deceive users into providing sensitive cryptocurrency information. Furthermore, the domain has been noted in 24 threat intelligence pulses on AlienVault OTX, underscoring its broad recognition within the cybersecurity community.

Given this information, it is imperative for defenders to take immediate action against the domain. Blocking access to claim-labs.com at the firewall or DNS level is recommended to prevent potential user interaction. Continuous monitoring for any new domains or variations associated with this threat actor is essential as they may attempt to evade detection. Users must be educated on the risks of engaging with such domains and advised to use caution when encountering unsolicited cryptocurrency-related offers.