claim-ponke[.]xyz

Analysis indicates that claim-ponke.xyz is currently active and classified as a crypto drainer. The domain resolves to IP 13.248.169.48, which is hosted on an AWS Global Accelerator endpoint in Canada, a location often leveraged to obscure true server origins. It presents a valid GoDaddy DV TLS certificate (GoDaddy.com / GoDaddy TLS Intermediate CA DV - R1v1) and returns HTTP 200, suggesting a functional web service. Threat intelligence shows the domain is listed in three security blocklists and appears in two AlienVault OTX pulses, providing independent corroboration of malicious intent. VirusTotal reports seven detections out of ninety‑one scanners, further supporting the risk assessment. Registration data ties the domain to GMO Internet Group, Inc. d/b/a Onamae.com, and the authoritative nameservers are ns5.afternic.com and ns6.afternic.com, both commonly used for rapidly deployed malicious infrastructure. No page content or payload details are available, leaving the exact phishing vector and wallet interaction unknown. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and treat any credential or wallet address submissions from this host as compromised. Continuous telemetry collection is advised to capture any evolving payloads or redirects that may emerge.