xvmclaim[.]xyz

Analysis of xvmclaim.xyz, created on September 12, 2025, shows a clear pattern of brand impersonation aimed at the cryptocurrency analytics platform dexscreener. The domain resolves to 172.67.187.127, an address owned by Cloudflare (AS13335) and located in the United States. Nameserver records point to aida.ns.cloudflare.com and lou.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site is currently taken offline, but historical evidence indicates it was serving content titled “$XVM - VOLT | Supercharging the Next Generation of RWA on XRP,” a phrasing that aligns with the crypto‑scam classification.

The registrar listed is NiceNIC International Group Co., Limited, a common conduit for disposable or short‑lived domains. Security telemetry places the domain on two independent blocklists—PhishDestroy and ScamSniffer—demonstrating that multiple threat‑intel feeds have identified it as malicious. VirusTotal scans returned three positive detections out of ninety‑five vendors, reinforcing the suspicion of malicious activity. Additionally, Gridinsoft assigns a trust score of 0 out of 100, and the domain lacks an SSL certificate, which is atypical for legitimate financial services sites.

While the exact payload or phishing page content has not been captured, the convergence of brand targeting, hostile hosting, blocklist presence, and low trust metrics indicates a high probability of a crypto‑related credential‑harvesting or fund‑diversion campaign. Defenders should block the domain at the network perimeter, add the associated IP address to deny lists, and monitor for any outbound connections to the same Cloudflare edge. Users of dexscreener should be warned to ignore any unsolicited communications referencing xvmclaim.xyz, and any credential submissions to that domain should be considered compromised.