lgnsclaim-origindefi[.]xyz

The domain lgnsclaim-origindefi.xyz is identified as an active CryptoDrainer threat, specifically designed to impersonate decentralized finance (DeFi) platforms with the goal of illicitly draining cryptocurrency assets. This domain is currently operational and has not been neutralized at the time of analysis. Further investigation is required to determine the full scope of its campaign and associated infrastructure.

Analysis indicates that lgnsclaim-origindefi.xyz exhibits characteristics consistent with cryptocurrency drainer malware delivery, including domain naming conventions that mimic legitimate claim or origin-based DeFi services. The domain was created on May 19, 2024, and currently resolves to a single IPv4 address: 172.67.177.108. Infrastructure analysis reveals the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. As of the latest scan, 2 out of 95 vendor detection engines on VirusTotal flagged the domain, indicating a low signature-based detection rate at this time. This suggests the domain remains under the radar of most security controls. The domain utilizes Cloudflare nameservers (dilbert.ns.cloudflare.com, maisie.ns.cloudflare.com), which may be leveraged for operational obfuscation and resilience against takedown efforts.

This domain represents an active and evolving threat within the cryptocurrency ecosystem. Based on observed behavior patterns, it is likely engaged in social engineering campaigns targeting users of DeFi platforms, prompting them to connect wallets or sign transactions under false pretenses. The lack of vendor detection combined with recent domain registration and operational hosting suggests a newly deployed campaign, possibly in the early stages of propagation.

Immediate mitigation is advised. Organizations and individuals should block network-level access to lgnsclaim-origindefi.xyz and its resolving IP address (172.67.177.108). DNS resolution queries for this domain should be logged and investigated for internal exposure. Users interacting with DeFi platforms are advised to verify all domain names and URLs manually, avoid clicking unsolicited links, and never sign transactions from untrusted sources. Website operators are encouraged to monitor for this domain in web application firewall logs and block traffic to its IP range. Given the domain’s active status and low detection rate, proactive threat hunting based on behavioral indicators (e.g., CryptoDrainer signatures, wallet connection prompts) is strongly recommended. Further intelligence sharing and takedown coordination through relevant abuse channels is advised to mitigate ongoing abuse.