claims-hedera[.]com

Analysis indicates that the domain claims-hedera.com was registered on March 30, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 188.114.96.3. The authoritative name servers are dion.ns.cloudflare.com and mona.ns.cloudflare.com, indicating the use of Cloudflare's DNS infrastructure. The domain remains active as of the report date (July 27, 2026) and is listed on a single security blocklist, specifically PhishDestroy, which has flagged it as a crypto‑drainer threat. VirusTotal scans show that five out of ninety‑one antivirus and URL‑reputation engines have marked the domain as malicious, reinforcing the suspicion of malicious activity.

No additional public threat‑intel sources such as OTX or Google Safe Browsing have been cited in the available data, and no SSL certificate details, HTTP response codes, or page‑title information have been disclosed, leaving those aspects unverified. The combination of recent registration, Cloudflare DNS, a known malicious blocklist entry, and multiple vendor detections suggests a high likelihood that the domain is being used to lure cryptocurrency users into transferring funds to attacker‑controlled wallets. Defenders should block network traffic to 188.114.96.3 and to claims‑hedera.com at the DNS level, add the domain to internal URL filtering policies, and monitor for any outbound connections that match the domain's pattern.

Incident response teams should also query the IP for any active services, capture any TLS certificates presented, and correlate logs for potential phishing emails or social‑engineering campaigns that reference the domain. Because the site’s content has not been publicly analysed, the precise phishing landing page and credential‑stealing mechanisms remain unknown; further sandbox analysis is recommended if a sample URL becomes available. Continuous re‑evaluation is advised, as the threat actor may modify hosting or expand the infrastructure.