claim[.]altlayer[.]la

Analysis of claim.altlayer.la indicates that the domain is associated with a crypto drainer operation. The domain was registered on February 21, 2026 and, as of the report date, has been taken offline. Infrastructure inspection shows that the domain resolves to the IPv6 address 2606:4700:3033::ac43:9d6f, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented by the host is issued by GTS CA 1P5, a standard Cloudflare‑managed certificate, confirming the use of Cloudflare’s CDN and SSL termination services.

Reputation data reveals that the domain is listed on two security blocklists and has been flagged by the anti‑phishing services PhishDestroy and ScamSniffer. VirusTotal reports that 15 of 93 security vendors have flagged the domain as malicious, reinforcing the malicious classification. Additional trust metrics show a Gridinsoft score of 0 out of 100, indicating a complete lack of trustworthiness. The known intelligence classifies the threat as a crypto scam, specifically a crypto drainer, but no page content, HTTP status code, or page title has been captured because the site is currently offline.

Consequently, the precise phishing vector, malicious payload, or targeted cryptocurrency addresses remain unknown. Defenders should proactively block claim.altlayer.la at network perimeter and DNS filtering layers, monitor for any re‑appearance of the domain or its associated IP range, and consider adding the domain to internal threat intelligence feeds. Continuous observation of Cloudflare‑owned address space for related activity is advised, given the likelihood of rapid re‑hosting by the threat actor.