claims-publicai[.]xyz

The domain claims-publicai.xyz was registered on February 21, 2026 and, as of the report date of July 25, 2026, is taken offline. DNS resolution points to the IP address 104.21.16.1, which belongs to the Cloudflare network (AS13335) and is geolocated to the United States. The site presented the page title “PublicAI Data Hub,” suggesting a data‑oriented front end, but no additional content analysis is available. The SSL certificate associated with the domain is identified as WE1, indicating the use of a standard TLS certificate without further validation details.

VirusTotal recorded a single positive detection out of 93 scanning engines, confirming at least one vendor’s assessment of malicious intent. The domain appears on five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among security products that the site is abusive. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the perception of high risk. The threat classification provided is a crypto drainer, a type of cryptocurrency‑related scam designed to illicitly acquire digital assets from victims.

While the presence of the page title and certificate confirm the site’s surface‑level identity, the exact mechanisms employed for the drainer operation remain undisclosed, and no sample payloads or URLs have been captured. Defenders should block claims-publicai.xyz at the DNS and network layers, add the IP 104.21.16.1 to outbound deny lists, and ensure that endpoint protection solutions incorporate the observed blocklist entries. Continuous monitoring of Cloudflare‑hosted IP ranges for re‑use of the address is advisable, as attackers frequently recycle infrastructure. Organizations should also review any recent crypto‑wallet activity for unauthorized transactions that could be linked to this campaign, and consider applying heightened alerts for internal communications that reference the “PublicAI Data Hub” name.