claims-derive[.]com

Analysis of claims-derive.com indicates it was created on 27 September 2024 via OwnRegistrar, Inc. The site resolves to 172.67.167.246, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate is presented, meaning the site is served only over HTTP, a common trait of malicious drop‑sites. The page title returned by the server is “Nur einen Moment…”, which provides no indication of legitimate content. VirusTotal records show the domain was scanned by 95 AV engines, none of which flagged it as malicious; however, the absence of detections does not constitute assurance of safety.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 / 100, reinforcing the suspicion of abuse. The infrastructure uses Cloudflare’s DNS with nameservers donovan.ns.cloudflare.com and dora.ns.cloudflare.com, a pattern frequently observed in fast‑flux or proxy‑based campaigns. The threat classification supplied is “Crypto Scam”, specifically a crypto drainer, suggesting the site may attempt to illicitly divert cryptocurrency assets.

At the time of reporting (24 July 2026) the domain is taken offline, but historical activity may still be referenced by threat‑intel feeds. Defenders should continue to block claims-derive.com at perimeter and DNS layers, monitor for any re‑appearance of the domain or its IP address, and consider adding the associated IP to internal reputation lists. Additional investigation of any HTTP payloads captured before takedown would be required to confirm the exact draining mechanism.