claim-pawstoken[.]net

On July 24, 2026 the domain claim-pawstoken.net was observed to be offline after being identified as a crypto‑drainer campaign. The domain was registered on September 27, 2024 through OwnRegistrar, Inc. and resolves to the Cloudflare edge address 104.21.32.1, which is advertised as belonging to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers jay.ns.cloudflare.com and serenity.ns.cloudflare.com. No TLS certificate is presented, indicating the site was served over plain HTTP when it was reachable.

The only visible HTML element captured by scanners is the page title “Nur einen Moment…”, which does not reveal any additional context about the malicious payload. The infrastructure was flagged by the PhishDestroy blocklist and appears on a single external security blocklist. VirusTotal analysis shows that one out of ninety‑five scanned security vendors raised a detection for the domain, reinforcing the suspicion of malicious intent. The threat classification supplied by the intelligence feed labels the activity as a “Crypto Scam”, consistent with the broader “crypto drainer” taxonomy.

Because the domain is currently taken offline, active probing is not possible, and the precise content of the malicious page remains unverified. Nevertheless, the combination of a recent registration, use of a high‑reputation CDN provider, lack of TLS, and the presence of a detection on VirusTotal suggests a low‑effort infrastructure typical of crypto‑drainer operations that aim to lure victims into sending cryptocurrency to an attacker‑controlled wallet. Defenders should continue to block the domain at perimeter filters, add the associated IP address 104.21.32.1 to deny lists, and monitor for any future re‑use of the same nameservers or Cloudflare edge IPs in new campaigns. Threat‑intel teams are advised to correlate any observed traffic to claim‑pawstoken.