tokens-claim[.]icu

This domain, tokens-claim.icu, was registered on 21 February 2026 and is presently taken offline. The site presented the page title “Nur einen Moment…”, a common placeholder used by malicious actors to delay user interaction. VirusTotal analysis shows that 4 of 93 scanning engines flagged the domain as malicious, indicating partial detection across the security community. It appears on one external blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as a crypto‑drainer campaign.

The SSL certificate, identified as WE1, is present but provides no legitimate validation, a typical characteristic of fraudulent infrastructure. The Gridinsoft trust score of 0 / 100 further confirms the lack of trustworthiness. No additional infrastructure details such as hosting IP, autonomous system number, or geographic location are publicly disclosed, limiting deeper attribution at this stage. Defenders should treat tokens-claim.icu as a high‑confidence indicator of a crypto‑drainer operation.

Immediate actions include adding the domain to internal DNS and web‑proxy blocklists, ensuring endpoint protection solutions ingest the four VirusTotal detections, and extending existing threat‑intel feeds with the blocklist reference. Continuous monitoring of newly observed DNS queries for the domain is advised, as threat actors may reactivate the site or reuse the same registration details in future campaigns. Where possible, correlate any inbound traffic to this domain with logs from crypto‑wallet interactions to spot potential fund‑exfiltration attempts. Given the low trust score and the confirmed blocklist presence, the domain should be considered malicious until proven otherwise.