claim[.]hoioworld[.]xyz

claim.hoioworld.xyz was registered on 11 September 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare's authoritative nameservers ariella.ns.cloudflare.com and pete.ns.cloudflare.com. The domain resolves to IP 104.21.69.182, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented, and HTTP requests return a minimal page whose title is “Just a moment…”, indicating that the site was likely serving a placeholder or a Cloudflare challenge page before being taken offline. The listed scam type is “Crypto Scam”, specifically a crypto drainer, suggesting that the infrastructure was intended to lure cryptocurrency users into submitting private keys or transaction signatures.

Reputation services give the domain extremely low scores: Gridinsoft rates it 0 / 100 and Scamadviser 30 / 100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that three out of ninety‑five security engines flagged the domain, reinforcing the suspicion. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one security community has identified it as abusive. Current operational status is offline; the site no longer serves content, but the domain remains registered and could be re‑used in future campaigns.

Defenders should continue to monitor the domain’s DNS and WHOIS records for any re‑activation, add the IP address 104.21.69.182 to network blocklists, and ensure that endpoint security solutions are updated to recognize the three VirusTotal detections. Email gateways and web proxies should be configured to block any URLs containing “claim.hoioworld.xyz” or its subdomains. Because the site used Cloudflare’s infrastructure, legitimate Cloudflare traffic may be affected if blanket blocks are applied; therefore, rule sets should be scoped to the exact hostname.