claims[.]hanafuda[.]world

Analysis of claims.hanafuda.world indicates a confirmed brand impersonation campaign targeting Binance users, classified as a crypto scam. The domain, registered on February 21, 2026, was taken offline by July 25, 2026, but remains a documented threat. Infrastructure analysis reveals it resolved to 104.21.58.136 (AS13335 Cloudflare, Inc., US), a common hosting pattern for phishing operations leveraging CDN services to obscure origin. The page title, 'Hanafuda | Deposit your assets and earn Hana Points and Hanafuda,' explicitly references cryptocurrency deposits, aligning with the reported scam type.

Detection data shows the domain appears on two security blocklists (PhishDestroy, ScamSniffer) and holds a Gridinsoft trust score of 0/100, confirming malicious classification. VirusTotal records one detection from 93 vendors, though this single flag does not fully capture its risk profile. The SSL certificate (WE1) is issued by a provider frequently used in both legitimate and malicious domains, offering no conclusive evidence of compromise but warranting caution. Defenders should treat this domain as a confirmed threat to Binance users, particularly those engaging with crypto deposit or reward schemes.

While currently offline, the domain may resurface under the same or altered infrastructure. Organizations should block the domain and IP at perimeter controls, monitor for related subdomains or newly registered lookalikes, and alert users to the 'Hanafuda' reward scam theme. No evidence links this domain to a specific phishing kit, and the exact content or redirection chain remains unanalyzed due to its offline status.