claim-perle[.]xyz

Analysis of claim-perle.xyz indicates that the site was active for a brief period before being taken offline, and it aligns with a crypto‑drainer campaign. The domain was registered on March 17 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and immediately pointed to the Cloudflare‑managed IP address 104.21.52.129, which belongs to ASN 13335 and is geolocated in the United States. DNS resolution used the Cloudflare nameservers tanner.ns.cloudflare.com and wally.ns.cloudflare.com, and the service presented a valid Let’s Encrypt TLS certificate, suggesting the operators were capable of obtaining legitimate SSL. Technology fingerprints collected from the live host show a Node.js back‑end running Express, with HTTP/3 enabled, HSTS enforced, and Cloudflare Browser Insights active, confirming the use of Cloudflare’s edge network for delivery.

The page title returned by the server was "Nur einen Moment…", a German phrase meaning "Just a moment…", which is commonly employed by malicious actors to delay user interaction. The site was classified as a crypto scam in the intelligence feed, and three of ninety‑four VirusTotal scanners flagged the domain, indicating that a minority of security engines detected malicious behavior. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and the SEAL threat‑intelligence platform, reinforcing the assessment of a crypto‑drainer operation.

While the offline status prevents direct verification of the payload or transaction flow, the convergence of registration timing, Cloudflare hosting, Node.js/Express stack, SSL presence, and the detection signals collectively support the conclusion that claim‑perle.xyz was used to lure victims into transferring cryptocurrency to addresses controlled by the adversary.