churchill-claims[.]net

churchill-claims.net is currently classified as a high‑risk crypto‑drainer infrastructure. The domain was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the IPv4 address 66.254.65.141, which is announced by AS7024 PixelGate and located in the United States. DNS resolution uses the hide.cz name servers (ns1.hide.cz, ns2.hide.cz). An HTTPS service is present with a Let’s Encrypt R13 certificate, but HTTP requests return a 403 status code, indicating that the site is deliberately restricting access. The page title returned by the server is “churchill-claims.net”, matching the domain name. Reputation data shows a Gridinsoft trust score of 0 / 100, the domain appears on one security blocklist, and it is listed as blocked by PhishDestroy. VirusTotal analysis reports that 2 of 93 scanning engines flagged the domain, confirming malicious behavior. The limited detection count suggests that the payload or activity may be evasive or newly deployed. No additional content or payload information is publicly available, so the exact mechanism of the crypto‑drainer (e.g., wallet hijacking, mining scripts, or transaction redirection) remains unknown. Defenders should block the domain and associated IP address at network perimeter devices, monitor DNS queries for the hide.cz resolvers, and add the domain to internal blacklists. Continuous re‑assessment is advised, as further indicators such as malicious payload hashes or C2 communications may emerge.