get-claimables[.]com

On 25 July 2026, the domain get-claimables.com was observed to be offline but retains indicators of a crypto‑drainer operation. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.67.131.157 located in the United States. DNS resolution points to two nameservers identified as expired-ns1.niceisp.com and expired-ns2.niceisp.com, which are typical of domains that have recently been abandoned or are being cycled for malicious use. VirusTotal records show that six of ninety‑three scanning engines flagged the domain as malicious, confirming a consensus of suspicion among security products.

The domain appears on a single external blocklist and is specifically listed by PhishDestroy as a known crypto‑drainer site. No TLS certificate was presented for the host, indicating that the site was served over plain HTTP, which is consistent with many low‑cost scam deployments. The page title returned by the HTTP response is “get-claimables.com”, offering no additional context about the payload or targeted brand. Because the site is currently taken offline, active content cannot be verified, and the exact phishing or malware mechanisms remain unknown.

However, the combination of recent registration, Cloudflare hosting, lack of encryption, and multiple vendor detections aligns with typical infrastructure used for crypto‑drainer scams that attempt to lure victims into submitting private keys or sending cryptocurrency to fraudulent addresses. Defenders should continue to block the domain at perimeter filters, update DNS blacklists with the observed IP address 172.67.131.157, and monitor for any re‑registration of the same name or similar aliases. Additional scrutiny of traffic to Cloudflare‑hosted IP ranges that lack TLS may help uncover related campaigns.