claim-espresso[.]xyz

This domain is flagged as an elevated-risk brand impersonation scam designed to deceive users into interacting with a fraudulent crypto airdrop portal. Analysis indicates the infrastructure mimics legitimate airdrop campaigns, specifically targeting the Espresso ecosystem, to harvest credentials or deploy wallet-draining malware. The threat type aligns with known crypto drainer pretexts, where victims are lured into connecting wallets under false pretenses of token distribution. Infrastructure analysis reveals the domain claim-espresso.xyz was registered on February 21, 2026, through Global Domain Group LLC. It resolves to the IP address 188.114.97.3 and has been blocked by four security blocklists, including MetaMask, ScamSniffer, SEAL, and PhishDestroy. The domain holds a Gridinsoft trust score of 0/100 and is flagged by 8 out of 95 security vendors on VirusTotal. The page title, 'Espresso Airdrop Claim Portal | Official Espresso Registration,' reinforces the impersonation of the Espresso Foundation, a known target for such scams. Mitigation requires immediate user awareness and technical controls. Users should avoid interacting with the domain or any associated links, particularly those prompting wallet connections or seed phrase input. Network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended for organizations. Security teams should monitor for similar impersonation patterns, such as domains mimicking legitimate airdrop portals, and update detection rules to include the registrar (Global Domain Group LLC) and creation date (February 21, 2026) as contextual indicators. Wallet software should enforce warnings for domains with low trust scores or prior blocklist entries.