claim[.]xyroapps[.]dev

This domain, claim.xyroapps.dev, is actively associated with a crypto drainer campaign as of July 12, 2026. The page title, "Claim $153_13," suggests a fraudulent giveaway scheme designed to lure victims into interacting with malicious smart contracts or wallet-draining scripts. The domain was registered on May 11, 2026, through TLD Registrar Solutions Ltd and is hosted behind Cloudflare infrastructure, resolving to the IP address 104.21.76.203. Analysis indicates the use of Cloudflare nameservers (eleanor.ns.cloudflare.com and mcgrory.ns.cloudflare.com), which is consistent with threat actors leveraging CDN services to obscure origin servers and evade takedowns. Infrastructure review reveals the domain holds a valid SSL certificate issued by Google Trust Services (WE1), a common tactic to appear legitimate. Despite this, the domain is flagged by one security vendor on VirusTotal and appears on a single blocklist, indicating early-stage detection. The HTTP status code 200 confirms the domain is currently active and serving content. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The scam type is identified as a fake giveaway, a method frequently employed to exploit users seeking cryptocurrency rewards. Defenders should treat this domain as a confirmed crypto drainer endpoint. The combination of a recent registration date, Cloudflare hosting, and a low detection rate suggests the campaign may still be in its initial deployment phase. Network-level blocking of 104.21.76.203 and the domain itself is recommended, along with monitoring for related subdomains under xyroapps.dev. Given the high-risk classification, any interaction with this domain should be assumed to result in unauthorized cryptocurrency transactions or wallet compromise. Additional scrutiny of wallet addresses or smart contracts referenced in the page source is advised to identify further indicators of compromise.