claim[.]nilcore[.]xyz

The domain claim.nilcore.xyz has been identified as a phishing site associated with a cryptocurrency drainer scam. This domain does not impersonate any known brand and does not use a known drainer kit. At present, claim.nilcore.xyz is offline, but it previously posed a risk to users by attempting to compromise cryptocurrency wallets. Individuals searching for information on whether claim.nilcore.xyz is safe or a scam should be aware that it is classified as a crypto drainer threat.

Technical analysis shows that claim.nilcore.xyz was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on August 31, 2025. The domain resolves to IP address 104.21.39.207, located in the US under AS13335 (Cloudflare, Inc.), and uses nameservers dane.ns.cloudflare.com and naomi.ns.cloudflare.com. The site does not have an SSL certificate. The observed page title is 'Nur einen Moment…'. On VirusTotal, 2 of 95 security vendors (including Gridinsoft and Trustwave) detect this domain as malicious. It appears on 1 security blocklist, specifically PhishDestroy. Google Safe Browsing does not flag the domain, and Scamadviser assigns it a trust score of 30 out of 100.

Anyone who interacted with claim.nilcore.xyz should immediately revoke any token approvals granted to the site and transfer their cryptocurrency assets to a new wallet to prevent further compromise. Users are advised to monitor their accounts for unauthorized transactions. Suspected phishing or scam activity involving claim.nilcore.xyz can be reported to relevant security authorities or blocklist operators to assist with ongoing threat mitigation.