claim-revtoks[.]cretrigov[.]live

This domain is flagged as a high-risk cryptocurrency drainer campaign site. Analysis of the infrastructure reveals registration through Spaceship, Inc. on February 21, 2026, resolving to IP address 172.67.164.38, which is hosted in the United States under AS13335 (Cloudflare, Inc.). The domain employs Cloudflare nameservers (roman.ns.cloudflare.com and delilah.ns.cloudflare.com) and utilizes Cloudflare Browser Insights, HTTP/3, and an SSL certificate issued by Google Trust Services (WE1). The page title, 'Just a moment...', is consistent with a Cloudflare challenge page, suggesting the site may be blocking direct access or employing anti-analysis measures. VirusTotal scanning shows 4 out of 95 security vendors flagging this domain as malicious, indicating partial but not widespread detection. The Gridinsoft trust score of 0/100, combined with a 403 HTTP status and blocking by PhishDestroy, corroborates the high-risk assessment. Defenders should note that the site remains active as of July 12, 2026, and appears on one security blocklist. The exact payload or landing page content has not been captured, but the scam type is explicitly cryptocurrency-related, implying the site is designed to drain wallet credentials or tokens. Recommended actions for defenders include blocking the domain and IP 172.67.164.38 at network boundaries, monitoring for related domains registered through Spaceship, Inc., and correlating with any cryptocurrency transaction logs for potential victim activity. The use of Cloudflare infrastructure may complicate takedown efforts, and sustained monitoring is advised given the domain's recent creation date and current active status.