claim-eclipse[.]xyz

Analysis of claim-eclipse.xyz indicates that the domain was actively used as a crypto‑draining scam before being taken offline. The domain was registered on February 21, 2026 and resolved to the IP address 199.191.50.11, which is hosted in the United States under ASN AS40034 belonging to Confluence Networks Inc. The site presented the page title "claim-eclipse.xyz," and its SSL certificate was issued by Encryption Everywhere DV TLS CA – G2, confirming the presence of HTTPS. VirusTotal records show that six of ninety‑three security vendors flagged the domain, providing independent corroboration of malicious intent.

Two independent blocklist services, PhishDestroy and ScamSniffer, have listed the domain, and it appears on two additional security blocklists, reinforcing its reputation as a threat. The scam type is identified as a crypto scam, consistent with the observed behavior of diverting cryptocurrency payments. The current status is offline, suggesting that the operators have removed the site, but the infrastructure footprint remains observable.

Defenders should continue to monitor the associated IP address and ASN for any re‑use, update endpoint protection and web filtering rules to block the domain and its IP, and share the indicator set with peer organizations. Because the domain was only recently created, the short lifespan aligns with typical fast‑flux or throwaway tactics used in crypto‑drainer campaigns. Further investigation is needed to determine whether additional domains or infrastructure components were linked to the same campaign, as no additional evidence beyond the listed indicators is presently available.