claim-trump[.]pro

Analysis of claim-trump.pro indicates that the domain was used for a crypto‑drainer campaign and has been taken offline as of the report date, July 24, 2026. The site lacked an SSL certificate, serving only HTTP, which reduces the confidence of encrypted communications. Registration was performed through Cloudflare, Inc., and the domain resolves to the IP address 104.21.45.105, which belongs to AS13335 owned by Cloudflare and is geolocated in the United States. Nameserver records point to james.ns.cloudflare.com and meiling.ns.cloudflare.com, confirming Cloudflare’s infrastructure involvement.

The page title returned by the server is "Nur einen Moment…", but no further content analysis is available, leaving the exact phishing landing page unknown. Detection data show that the domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans recorded two positive detections out of ninety‑five vendors, suggesting limited but notable malicious classification. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of abuse.

The listed scam type is a Crypto Scam, consistent with the observed crypto‑drainer behavior. Uncertainties remain regarding the specific payload or transaction mechanisms used, as no malware samples or network traffic were captured. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑hosted IP ranges for similar activity is advised, as the infrastructure can be reused for future campaigns.