claim[.]aibotiyi[.]cfd

Analysis of claim.aibotiyi.cfd confirms its classification as an active cryptocurrency drainer site, targeting users with fraudulent wallet-draining mechanisms. The domain, registered on February 21, 2026, through Dynadot LLC, currently resolves to 104.21.112.1, a Cloudflare-hosted IP address within AS13335. Infrastructure analysis reveals the use of Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), both common in phishing operations to obscure origin and enhance perceived legitimacy. The domain returns an HTTP 200 status, though the visible page title indicates a 521 error, suggesting backend misconfiguration or deliberate evasion of automated detection tools. Technical indicators align with known cryptocurrency scam patterns. The domain appears on at least one security blocklist, and one of 95 vendors on VirusTotal flags it as malicious. While the low detection rate may reflect limited exposure or recent activation, the presence of HTTP/3 and Cloudflare technologies further complicates attribution and takedown efforts. The domain’s creation date, five months prior to this report, suggests it may have been staged for future use or operated intermittently to avoid scrutiny. Defenders should treat this domain as high-risk. Network-level blocking of 104.21.112.1 and associated Cloudflare IP ranges is recommended, alongside monitoring for connections to claim.aibotiyi.cfd in web proxy or DNS logs. Given the cryptocurrency drainer classification, wallet interactions with this domain should be investigated for unauthorized transactions. The use of Cloudflare infrastructure does not preclude mitigation; organizations can leverage existing relationships with the provider to request takedowns or additional scrutiny. No legitimate use case for this domain has been identified, and its continued resolution despite the 521 error warrants proactive containment.