claim-gacha[.]com

Analysis of the domain claim-gacha.com reveals active infrastructure supporting a high-risk crypto drainer campaign as of July 12, 2026. The domain was registered on June 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abuse-prone registrations. It currently resolves to the IP address 172.67.150.206, which is geolocated to a Cloudflare-operated node in Canada, a common proxy service used to obscure backend hosting. The domain returns an HTTP 200 status, indicating an operational endpoint, and is secured with an SSL certificate issued by Google Trust Services under the WE1 intermediate, suggesting standard encryption practices rather than malicious intent in certificate selection. Detection metrics provide further evidence of malicious classification. The domain appears on three independent security blocklists, and six out of ninety-five security vendors on a widely used aggregation platform flag it as malicious. Major detection systems, including those maintained by browser security extensions and wallet protection layers, have already blocked access to this domain, signaling a coordinated response to an identified threat. The infrastructure remains active, with no signs of takedown or disruption as of the report date. The specific threat classification as a crypto drainer is supported by the domain's naming convention and detection context, though direct forensic evidence of wallet-draining payloads is not presented in the available data. The use of Cloudflare IP space complicates attribution and backend analysis, as the true origin server remains concealed. Defenders should treat this domain as a confirmed malicious endpoint and prioritize blocking at the network and application layers. Given the domain's recent registration and continued operation, monitoring for related domains registered through the same registrar or resolving to adjacent IP ranges may help identify additional components of this campaign.