claim-etherna[.]pro

The domain claim-etherna.pro was identified as a crypto‑drainer scam and has been taken offline as of the report date. The site was blocked by the PhishDestroy service and appears on a single security blocklist. Infrastructure analysis shows the domain is delegated to Cloudflare’s authoritative nameservers coleman.ns.cloudflare.com and gemma.ns.cloudflare.com, pointing to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate was presented; the service responded without HTTPS, which aligns with many low‑cost scam deployments that rely on Cloudflare’s edge protection while avoiding certificate costs.

Registration was performed through PDR Ltd. operating under the trade name PublicDomainRegistry.com, a registrar frequently used for disposable or short‑lived malicious domains. The page title returned by the HTTP response is “Un momento…”, offering no additional context about the payload. The domain was scanned by 95 anti‑malware engines on VirusTotal, none of which raised a detection at the time of scanning, but the absence of detections does not imply safety. A Gridinsoft trust score of 0 out of 100 further indicates a poor reputation.

Because the site is no longer reachable, no payload samples have been captured, leaving the exact method of coin extraction unknown. Defenders should ensure the domain is added to DNS and web‑proxy blocklists, monitor for any resurrection of the domain or reuse of the associated IP address, and enforce outbound filtering that flags connections to Cloudflare edge nodes serving unencrypted traffic from suspicious domains. Continuous observation of registration patterns from PublicDomainRegistry.com and of similar “Un momento…” page titles may aid early detection of repeat operators. In summary, claim‑etherna.pro exhibits the classic infrastructure footprint of a crypto‑drainer operation and should be treated as hostile.