claim-zerofees[.]com

The domain claim-zerofees.com is currently active and serves a page titled “claim-zerofees.com — Domain welcome page for”. The site returns HTTP status code 200, indicating a reachable web service, but it lacks an SSL certificate, exposing all traffic to potential interception. Registration data shows the domain was created on February 22, 2026 through Sav.com, LLC, and it is delegated to the nameservers ns1.all-harmless.domains and ns2.all-harmless.domains. Infrastructure analysis places the resolved IPv4 address 172.86.76.148 in the United Arab Emirates, owned by AS14956 RouterHosting LLC, confirming the hosting provider.

The domain’s trust score on Scamadviser is 21 out of 100, reflecting a high likelihood of malicious intent. VirusTotal scans have identified the domain as suspicious, with three of ninety‑five security engines flagging it. Additionally, the domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto‑drainer operation. Email infrastructure is minimal, with a single MX record (priority 10) pointing to mx.all-harmless.domains, suggesting limited or no legitimate mail use.

While the page title provides no further context about the specific payload or victim interaction, the combination of low trust score, flagged detections, blocklist presence, and absence of TLS strongly indicates a high‑risk crypto‑draining campaign. Defenders should block the domain at DNS and network layers, monitor outbound connections to the associated IP address, and ensure that endpoint security solutions are updated to include the latest detection signatures. Organizations using cryptocurrency wallets should also enforce multi‑factor authentication and educate users about the risk of unsolicited claims of fee‑free services, as the domain’s naming pattern appears designed to lure such victims.