claim-worldshards[.]xyz

The domain claim-worldshards.xyz was registered on 21 February 2026. Passive DNS shows it resolves to 172.67.216.193, an address owned by Cloudflare, ASN 13335, located in the United States. The TLS certificate presented is identified as WE1, which is typical of Cloudflare‑issued certificates. Gridinsoft scores the domain at 0 out of 100, indicating a very low trust rating.

VirusTotal has recorded detections from eight of ninety‑five scanning engines, confirming malicious activity. The domain appears on two public blocklists and is currently listed by PhishDestroy and ScamSniffer as a known crypto‑draining scam. The infrastructure has been taken offline according to the latest intelligence, but the historical indicators remain relevant for correlation and remediation. Defenders should update network and DNS filtering policies to block both the domain and its resolved IP address, add the IP to any threat‑intel feeds, and monitor for any resurrection attempts that may use alternative Cloudflare IPs.

Continuous monitoring of Cloudflare‑originating traffic for suspicious crypto‑related payloads is advised. Because the site is no longer reachable, active probing is not possible, and the exact payload or page content remains unknown; however, the combination of low trust score, multiple vendor detections, and blocklist presence strongly suggests a crypto‑drainer operation. Organizations should also consider reviewing outbound transaction logs for unauthorized crypto‑wallet interactions that could be linked to this indicator. In summary, claim-worldshards.xyz should be treated as a high‑confidence malicious indicator and blocked across all layers until further evidence indicates remediation.