claim-common[.]xyz

This domain, claim-common.xyz, is identified as a crypto drainer phishing site designed to illicitly extract cryptocurrency assets from victim wallets. Analysis indicates the site employs a drainer kit, a malicious toolset that automates the unauthorized transfer of digital assets upon interaction. No legitimate brand association is observed, suggesting the domain operates as a standalone fraudulent entity. The page title 'Um momento…' implies an attempt to mimic loading states or legitimate services, a common tactic to deceive users during the phishing process. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 172.67.179.215, hosted on Cloudflare’s network (AS13335), a frequent choice for threat actors due to its anonymity and resilience. It was registered on October 27, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar historically associated with high volumes of malicious domains. Detection metrics include a VirusTotal score of 11/95 security vendors flagging the domain, alongside presence on two independent blocklists. No SSL certificate is configured, further reducing its legitimacy. As of the latest assessment, claim-common.xyz has been taken offline, likely due to enforcement actions or abandonment by the threat actor. However, residual risk persists for users who may have interacted with the domain prior to its deactivation. Victims are advised to revoke any connected wallet permissions and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Continuous monitoring of newly registered domains under the same registrar is recommended to identify potential successor campaigns.