claimportal[.]pages[.]dev

Analysis of the domain claimportal.pages.dev indicates active infrastructure used for a crypto‑drainer campaign. Registration data show the domain was created on 28 February 2024 and the name was provisioned through Cloudflare Pages, a service that supplies both DNS and hosting. DNS resolution points to the IPv4 address 188.114.96.3, an address commonly observed in other malicious publications and currently listed on at least one public security blocklist. The domain is also listed by the PhishDestroy blocklist, confirming that external threat‑intelligence feeds have flagged it as hostile.

VirusTotal scans show that 3 of 91 security‑vendor engines have returned a malicious verdict, reinforcing the suspicion of abusive activity. The threat type is identified as a crypto drainer, meaning the site is likely intended to trick victims into sending cryptocurrency to attacker‑controlled wallets. The risk rating is elevated and the status remains active as of the report date, 29 July 2026. At present, no public page title or content snapshot has been released, so the exact visual or textual content of the site is unknown.

Defenders should add the domain and its associated IP address to outbound‑traffic deny lists, enforce DNS sink‑holing for the name, and monitor network flows for connections to 188.114.96.3. Additional mitigation steps include updating endpoint detection rules to flag any process that attempts to resolve or contact this domain, reviewing internal logs for prior communications, and isolating any internal accounts that may have disclosed cryptocurrency addresses. Continuous observation of the blocklist entries and periodic rescans on VirusTotal are recommended to detect any change in the detection count or additional vendor classifications.