claim-river[.]xyz

Analysis conducted on July 25 2026 identifies claim-river.xyz as a confirmed crypto‑drainer infrastructure that has been taken offline. The domain was registered through Dynadot LLC on 12 March 2026 and is hosted on Cloudflare’s network (ASN 13335) using the IP address 188.114.97.3, which resolves to a US location. DNS is served by craig.ns.cloudflare.com and marge.ns.cloudflare.com, and the site presented a TLS certificate from Let’s Encrypt (E7) indicating the use of standard automated HTTPS provisioning. HTTP traffic was observed over HTTP/3, and the last reachable page returned a 504 Gateway timeout, suggesting the backend service was unavailable at the time of testing.

Threat intelligence sources have placed the domain on a single security blocklist and it is listed as blocked by the PhishDestroy service. VirusTotal scans recorded two positive detections out of ninety‑four scanners, reinforcing the malicious classification. The only publicly visible artifact is the page title “claim-river.xyz | 504: Gateway time‑out”, which does not disclose further content. While the offline status limits current payload analysis, the combination of recent registration, Cloudflare‑based hosting, a Let’s Encrypt certificate, and detections by multiple vendors aligns with observed patterns of crypto‑drainer campaigns that lure victims into sending cryptocurrency to attacker‑controlled wallets.

No additional infrastructure such as command‑and‑control endpoints or credential‑phishing pages has been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address 188.114.97.3 to threat‑intel feeds. Given the Cloudflare fronting, any future activity may appear from the same ASN, so correlation with other recent crypto‑drainer indicators is recommended. Ongoing observation of the registrar Dynadot for similar domains may provide early warning of related campaigns.