claims-steer[.]finance

Analysis of claims-steer.finance confirms its classification as an active crypto drainer phishing domain, targeting users through a fake airdrop scam. The domain was registered on March 27, 2026, and remains operational as of July 12, 2026, resolving to IP address 188.114.96.3, hosted behind Cloudflare infrastructure in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (ian.ns.cloudflare.com, romina.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E8), which are common among both legitimate and malicious sites but do not mitigate the threat. Security vendors have flagged the domain, with 5 of 94 engines on VirusTotal detecting malicious activity, though this number may underrepresent the threat due to delayed or incomplete scanning. The domain appears on one security blocklist and has been documented in a single AlienVault OTX threat intelligence pulse, indicating limited but confirmed malicious activity. Gridinsoft assigns a trust score of 0/100, further supporting its classification as high-risk. The scam type is explicitly identified as a fake airdrop, a tactic frequently used to lure victims into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. No specific brand impersonation is confirmed in available data, and the exact content of the site remains unanalyzed. Defenders should treat this domain as an active threat, blocking resolution at the DNS level and monitoring for related infrastructure, such as associated IP addresses or newly registered domains under the same registrar (NICENIC INTERNATIONAL GROUP CO., LIMITED). Further investigation into wallet addresses or smart contracts linked to this domain is recommended to disrupt the drainer operation.