claimhuddle-network[.]live

Analysis of the domain claimhuddle-network.live indicates it was actively involved in a crypto drainer campaign, classified as an elevated-risk threat. The domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to the IP address 104.21.16.231, hosted under AS13335 (Cloudflare, Inc.), a common configuration for malicious domains leveraging Cloudflare’s proxy services to obscure origin servers. Nameservers aldo.ns.cloudflare.com and lilyana.ns.cloudflare.com further confirm Cloudflare’s role in the domain’s DNS resolution. Detection data from July 24, 2026, shows the domain was flagged by 2 of 93 security vendors on VirusTotal, a modest but notable detection rate suggesting malicious intent.

Gridinsoft assigned a trust score of 0/100, reinforcing the domain’s high-risk classification. The domain appears on at least one security blocklist, and PhishDestroy has explicitly blocked it, corroborating its malicious status. The observed page title, 'Just a moment...', is consistent with Cloudflare’s interstitial challenge pages, often encountered during automated or manual access attempts to phishing or scam sites. No SSL certificate was detected for claimhuddle-network.live, which is atypical for legitimate services but not uncommon for short-lived phishing domains.

The domain’s current status is offline, though this does not preclude future reactivation under the same or similar infrastructure. Defenders should treat this domain as part of a crypto drainer operation, given its explicit classification in threat intelligence sources. Network-level blocking of the IP 104.21.16.231 and monitoring for related domains registered through NiceNIC or using Cloudflare’s nameservers is recommended.