claim[.]fabric-foundation[.]lat

Analysis of claim.fabric-foundation.lat indicates a short‑lived crypto‑drainer operation that was taken offline prior to the assessment date of July 24, 2026. The domain was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and does not present an SSL certificate, leaving HTTP connections unencrypted. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (ASN13335) and geolocated to the United States. The domain relies on Cloudflare’s authoritative nameservers audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, a common choice for fast‑hosted phishing infrastructure that benefits from Cloudflare’s built‑in DDoS mitigation and reputation masking.

The only visible content captured before takedown was the page title “$ROBO Airdrop,” matching the known Airdrop Scam phishing kit. This kit typically lures victims with promises of free cryptocurrency airdrops and then redirects them to malicious wallets or malicious contract interactions designed to siphon tokens. The threat classification in the intelligence is “Crypto Scam,” and the broader threat type is identified as a crypto drainer, consistent with the airdrop‑luring approach.

Reputation signals show limited but concrete blocking: the domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal analysis recorded three detections out of ninety‑three scanners, reinforcing the malicious nature despite a relatively low detection ratio. No additional Safe Browsing or OTX entries are present in the supplied data.

Given the evidence, defenders should immediately add claim.fabric-foundation.lat to URL filtering policies and block outbound connections to its resolving IP, 188.114.97.3. Continuous monitoring of Cloudflare‑hosted IP ranges for emergent domains that reuse the same nameservers or exhibit the “$ROBO Airdrop” page title is advisable.