claimwet[.]live

The domain claimwet.live was registered on December 12, 2025 and is presently taken offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.142.186, which belongs to AS13335 operated by Cloudflare, Inc., placing the host in the United States. The domain is served through Cloudflare’s authoritative nameservers marlowe.ns.cloudflare.com and martin.ns.cloudflare.com, and no SSL certificate is presented, indicating that HTTPS was not configured at the time of observation. Registration details list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar, a common conduit for low‑cost registrations.

A Gridinsoft trust score of 0 out of 100 further underscores the lack of reputation for the domain. Threat intelligence sources have placed claimwet.live on two security blocklists; it is specifically blocked by PhishDestroy and ScamSniffer. VirusTotal scans show that five of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. The identified scam type is a crypto scam, consistent with a crypto‑drainer operation that typically attempts to lure victims into transferring cryptocurrency to attacker‑controlled wallets.

While the site is currently offline, the combination of a newly created domain, absence of TLS, low trust score, blocklist inclusion, and multiple vendor detections provides a strong indicator of malicious intent. Uncertainty remains regarding the exact phishing page content, the specific cryptocurrency addresses targeted, and whether any active command‑and‑control infrastructure was associated before takedown. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, monitor for any residual traffic to the IP address 172.67.142.186, and consider adding the domain to internal blacklists.