horizen-zenclaim[.]app

The domain horizen-zenclaim.app is flagged as a crypto‑drainer scam. Technical analysis shows the site was hosted on Cloudflare’s network (AS13335) with the IPv4 address 188.114.96.3, which resolves to a US location. The domain uses Cloudflare‑provided nameservers (julian.ns.cloudflare.com and rachel.ns.cloudflare.com) and was registered through Cloudflare, Inc., indicating the attacker leveraged the provider’s privacy and rapid provisioning features. No TLS certificate is present, leaving HTTP traffic unencrypted and exposing users to man‑in‑the‑middle interception.

The page title returned by the HTTP response is "Nur einen Moment…", a German phrase meaning "Just a moment…", which is commonly used by malicious sites to delay user interaction. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, the lowest possible rating, and the domain appears on a single security blocklist. VirusTotal scans report that six of ninety‑five antivirus engines flag the domain, reinforcing the suspicion of malicious activity. PhishDestroy has already added the domain to its blocklist, confirming community‑wide awareness of the threat.

The site is currently offline, preventing further content inspection, and the lack of an active SSL certificate or HTTPS endpoint limits any immediate credential capture capability, but the infrastructure remains usable for future deployments. Defenders should proactively block horizen-zenclaim.app at DNS and proxy layers, add the associated IP address 188.114.96.3 to deny lists, and monitor for any new subdomains or similar Cloudflare‑hosted domains that appear with comparable characteristics. Continuous observation of threat‑intel feeds for additional indicators of compromise related to this domain is recommended, as the offline status may be temporary and the attacker could reactivate the site with updated payloads.