multichainswiftclaim[.]app

multichainswiftclaim.app is currently classified as a high‑risk cryptocurrency drainer. The domain remains active as of 12 July 2026 and returns HTTP 403 for the root request. The site presents the page title “Nur einen Moment…”, indicating a possible waiting page, but no further content has been disclosed. Infrastructure analysis shows the domain is hosted behind Cloudflare’s network. Authoritative name servers are lewis.ns.cloudflare.com and rosa.ns.cloudflare.com, and the domain resolves to 172.67.170.178, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The service uses Cloudflare’s SSL certificate issued by Google Trust Services under the WE1 root, and HTTP/3 is enabled. Reputation signals are uniformly negative. Gridinsoft assigns a trust score of 0 / 100. The domain appears on four independent blocklists and is actively listed by PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis reports a single positive detection out of 95 scanners, reinforcing the malicious classification. The only observable indicator beyond the infrastructure is the page title; no malware samples, redirect chains, or credential‑capture mechanisms have been captured, leaving the exact drainer payload unknown. Analysts should treat the lack of visible content as a deliberate evasion technique. Defenders should block DNS resolution for multichainswiftclaim.app, enforce outbound filtering on connections to 172.67.170.178, and monitor Cloudflare‑origin traffic for anomalous HTTP/3 requests. Continuous re‑scanning with multiple sandbox services is advised to capture any future payload changes.