claim[.]calderafoundatione[.]xyz

On 24 July 2026, claim.calderafoundatione.xyz was identified as a crypto‑drainer infrastructure that has been taken offline. The domain was registered on 16 October 2025 through PublicDomainRegistry.com (operated by PDR Ltd.) and is delegated to Cloudflare’s authoritative name servers donna.ns.cloudflare.com and howard.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return a generic “Just a moment…” title, indicating that the site served a placeholder page rather than a fully‑featured phishing portal. DNS resolution points to 172.67.177.226, an address owned by AS13335 Cloudflare, Inc., located in the United States.

The use of Cloudflare’s network suggests an attempt to hide the true origin of the malicious host and to benefit from the provider’s DDoS mitigation services. VirusTotal has recorded detections from six of ninety‑five scanners, confirming the presence of malicious indicators associated with crypto‑draining activity. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy community, providing additional corroboration of its abusive nature. No other public reputation services (e.g., Google Safe Browsing, OTX) are cited in the available intelligence, and the lack of an SSL certificate further reduces the site’s credibility.

Given the limited but concrete evidence, defenders should add claim.calderafoundatione.xyz to network‑level deny lists, monitor the associated IP address for any resurgence, and ensure that endpoint security solutions ingest the VirusTotal detection signatures. Because the domain is currently offline, ongoing observation is advised to capture any re‑deployment attempts that may reuse the same infrastructure or adopt new hosting. The combination of recent registration, Cloudflare hosting, absence of TLS, and multiple vendor detections substantiates an elevated risk classification for this crypto‑drainer operation.