claim-bonus[.]top

Analysis of the domain claim-bonus.top shows a short‑lived crypto‑drainer infrastructure that was taken offline as of the report date, 24 July 2026. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 46.30.43.113, which is hosted in the Netherlands under ASN 216139 (Iron Hosting Centre LTD). DNS resolution is delegated to four CloudNS nameservers (pns41.cloudns.net., pns42.cloudns.net., pns43.cloudns.net., pns44.cloudns.net.). A TLS certificate presented by the site is issued to PhishDestroy / botadmin.destroy.tools, indicating that the certificate itself is part of a known phishing‑related blocklist.

The HTTP response returns status 200, and the only observed page title is “Website claim-bonus.top is ready. The content is to be added,” suggesting that the site was either a placeholder or awaiting payload deployment before being shuttered. VirusTotal scans show that five of ninety‑five security vendors flagged the domain, and the domain appears on one external security blocklist where it is explicitly blocked by PhishDestroy. The Gridinsoft trust score of 0 / 100 further reinforces its malicious reputation.

While the site is currently offline, the combination of a low‑trust score, malicious SSL issuance, vendor detections, and blocklist inclusion confirms that the domain was used for a crypto‑drainer scam. Defenders should continue to block traffic to claim-bonus.top at the DNS and firewall layers, monitor for any re‑registration attempts, and add the IP address 46.30.43.113 to threat‑intel feeds. Ongoing vigilance is advised because the hosting provider and name server configuration could be reused for future malicious campaigns.