claimtoprewards[.]sbs

The domain claimtoprewards.sbs was registered on December 05, 2025 through NiceNIC International Group Co., Limited and currently resolves to the IP address 172.67.160.38, which is hosted by Cloudflare (AS13335) in the United States. The authoritative nameservers are adrian.ns.cloudflare.com and joaquin.ns.cloudflare.com, and the site is served over TLS using a Google Trust Services / WE1 certificate. The page title observed is "Nur einen Moment…" and the site returns an HTTP 403 status code, indicating restricted access.

Detection signals show that the domain is actively flagged by security products: 11 of 95 vendors on VirusTotal have marked it as malicious, and Gridinsoft assigns a trust score of 0 out of 100. It appears on one external blocklist and has been blocked by the PhishDestroy service. The infrastructure leverages Cloudflare’s HTTP/3 protocol, which can obscure traffic patterns and complicate direct attribution.

The threat classification is a cryptocurrency drainer, consistent with the "scam type: cryptocurrency" label. While the exact payload or payment address has not been disclosed, the combination of a low trust score, multiple vendor detections, and the presence of a German‑language page title suggests a targeted campaign aimed at extracting crypto assets from victims. The site’s current status is marked as active, confirming ongoing operation.

Defenders should add claimtoprewards.sbs to network and endpoint blocklists, enforce DNS filtering, and monitor outbound connections to the IP 172.67.160.38. Given the use of Cloudflare’s CDN, consider employing TLS inspection where policy permits to reveal hidden request details. Continuous re‑evaluation of threat intelligence feeds is recommended, as the infrastructure could shift to alternate Cloudflare‑protected hosts or adopt additional evasion techniques.