soldapp[.]claims

This domain, soldapp.claims, is identified as a crypto drainer phishing endpoint designed to illicitly siphon cryptocurrency assets from victims. Analysis indicates no direct brand impersonation, suggesting a generic or opportunistic attack vector rather than a targeted campaign. The domain exhibits characteristics consistent with known drainer kits, including the use of Cloudflare-hosted infrastructure to obscure origin servers and evade detection. The page title 'Just a moment...' is a common obfuscation technique used to mimic legitimate loading screens while executing malicious scripts in the background. Infrastructure analysis reveals the domain resolves to the IP address 104.21.74.166, geolocated to Cloudflare, Inc. in Canada. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Detection metrics show 9 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or intermittent flagging. The domain is currently offline, likely due to takedown actions or infrastructure rotation by threat actors. Despite its inactive status, the residual risk remains elevated due to the domain's recent registration date and association with crypto drainer activity. Organizations and individuals are advised to block the domain and IP at the network level, monitor for related indicators of compromise, and educate users on recognizing crypto-related phishing attempts. The use of Cloudflare and a short-lived domain lifecycle suggests the threat actors may re-emerge under similar infrastructure, warranting continued vigilance.