claim-lombard[.]world

The domain claim-lombard.world was observed hosting a crypto‑drainer operation and is currently reported as taken offline. Technical resolution shows the domain points to the Cloudflare edge address 104.21.42.224, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. Authoritative nameservers for the zone are jihoon.ns.cloudflare.com and olga.ns.cloudflare.com, confirming that the domain leverages Cloudflare DNS infrastructure. No TLS certificate was presented for the host, indicating that the site was served without HTTPS encryption.

The page title returned by the HTTP response is "Nur einen Moment…", a German phrase meaning "Just a moment…", but no further content analysis is available. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low reputation. The domain appears on a single security blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal scans recorded five positive detections out of ninety‑five submitted security vendors, reinforcing the malicious classification.

The threat type is identified as a crypto scam, consistent with the crypto‑drainer label. While the available data confirms the presence of malicious infrastructure, the exact phishing content, victim targeting, and any associated command‑and‑control endpoints remain unverified due to the offline state of the site. Defenders should continue to block the domain at network perimeters, update intrusion‑prevention signatures to include the observed IP address and nameserver records, and monitor for any re‑registration attempts. Ongoing surveillance of Cloudflare‑hosted IP ranges for similar activity is advised, as is periodic re‑query of VirusTotal and other threat‑intel sources to capture any new detections that may arise if the domain resurfaces.