claim[.]exsol[.]rest

The domain claim.exsol.rest is presently classified as a high‑risk crypto drainer infrastructure. It was first observed on 12 July 2026 and is listed on the PhishDestroy blocklist. The site returns an HTTP 308 redirect and presents a page titled “Digital Sovereignty Foundation Claim”, indicating an attempt to associate the page with a legitimate‑sounding organization.

Technical resolution shows the domain resolves to the IPv4 address 198.18.2.145, which is registered to AS202412 Omegatech LTD in the Netherlands. The domain’s registration record lists Web Commerce Communications Limited as the registrar and the creation timestamp of 12 November 2025. DNS is served by Cloudflare, using the authoritative nameservers annalise.ns.cloudflare.com and chris.ns.cloudflare.com. The TLS certificate presented by the host is identified as 91-92-242-155.virtualine.org, suggesting the use of a shared or mis‑issued certificate rather than a domain‑matched credential.

VirusTotal analysis flags the domain in 2 of 95 security vendor scans, and the domain appears on a single known security blocklist. While the limited number of detections may reflect a recent deployment, the presence of a crypto‑drainer label and the use of a reputable CDN point to a purposeful attempt to obscure origin and increase reliability for victim interaction. The exact payload, transaction flow, or cryptocurrency address collection mechanism has not been publicly disclosed, leaving the specific method of fund extraction unknown.

Defenders should block DNS resolution for claim.exsol.rest at network perimeters and enforce outbound filtering of connections to 198.18.2.145. Monitoring of HTTP 308 responses from the domain and inspection of TLS certificates matching 91-92-242-155.virtualine.org may provide early indicators of compromise. Adding the domain to internal blocklists and sharing the indicator set with upstream threat‑sharing communities will reduce exposure to the reported high‑risk activity.