claim[.]nexus-rewards[.]xyz

claim.nexus-rewards.xyz is classified as an active crypto drainer with a high risk rating. The domain was created on May 27 2026 and is currently listed on a security blocklist. PhishDestroy has already blocked the domain, indicating that it is engaged in abusive activity targeting cryptocurrency assets. Two of ninety‑five VirusTotal security vendors have flagged the domain for malicious behavior.

The hosting infrastructure relies on Cloudflare’s network, resolving to the IPv4 address 188.114.97.3, which is geolocated to Canada. The domain uses a Let's Encrypt certificate identified as version E8, providing TLS encryption but offering no protection against the underlying malicious payload. HTTP requests to the site return a 403 status code, suggesting deliberate access denial or evasion. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputational standing of the host.

Registration details point to NameSilo, LLC as the registrar, with authoritative nameservers hank.ns.cloudflare.com and virginia.ns.cloudflare.com. The combination of a fresh registration, low trust score, and Cloudflare‑proxied IP is typical of fast‑flux or disposable infrastructures employed by cryptocurrency‑draining campaigns. The limited detection by VirusTotal (2/95 vendors) implies that the payload may be custom or actively evading broader detection, while the presence on a blocklist confirms at least one security feed has identified it as malicious.

Defenders should immediately add claim.nexus-rewards.xyz to network blocklists and firewall deny lists. Monitoring for DNS queries to the associated Cloudflare nameservers can reveal compromised clients attempting to reach the domain. Where possible, sinkholing the resolved IP or enforcing TLS inspection may capture further indicators of the drainer payload. Continuous threat‑intel feeds should be consulted for any emergence of additional indicators tied to this infrastructure.