claims-firelight[.]com

This domain, claims-firelight.com, is identified as an active crypto drainer infrastructure designed to siphon cryptocurrency assets from victims through deceptive transaction prompts. Analysis indicates no legitimate brand association, suggesting the domain operates purely as a malicious endpoint for a drainer kit, likely leveraging the seed identifier fb3067 for campaign tracking. The site presents a transient page titled 'Un instant…', a common tactic to delay detection while awaiting user interaction or redirecting to fraudulent wallet interfaces. Infrastructure analysis reveals the domain was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an atypical future registration date that may indicate domain spoofing or registry manipulation. It resolves to the IPv6 address 2606:4700:3030::6815:588c, hosted on AS13335 Cloudflare, Inc., a network frequently exploited for its anonymity and DDoS protection. The SSL certificate is issued by Let's Encrypt (serial E8), providing HTTPS legitimacy while obscuring malicious intent. Security telemetry shows the domain is flagged by 3 blocklists and detected by 2 of 95 vendors on VirusTotal, with active blocks from PhishDestroy, MetaMask, and SEAL. As of the latest assessment, claims-firelight.com remains active, posing a high risk to users engaging with cryptocurrency transactions. No takedown or sinkholing actions have been observed, and the domain continues to resolve. Users are advised to treat all interactions with this domain as malicious, verify wallet addresses independently, and report the infrastructure to security providers for mitigation. The combination of Cloudflare hosting, future-dated registration, and confirmed drainer activity underscores the need for heightened vigilance in crypto-related workflows.