claim[.]qubit[.]us[.]com

The domain claim.qubit.us.com was registered on 2026-02-21 through a corporate registrar and is currently resolved to the IP address 188.114.96.3, which belongs to a cloud service provider operating out of Canada. The domain serves an HTTP 200 response with the default Apache test page titled "Apache HTTP Server Test Page powered by CentOS," indicating no overt malicious payload is delivered at the root URL, but the presence of a generic test page is a common staging tactic for credential‑stealing or crypto‑draining infrastructure. The domain is listed as a crypto_drainer threat with a high risk rating; Gridinsoft assigns a trust score of 0/100, and one of ninety‑three security scanners on VirusTotal has flagged the site. It is actively blocked by PhishDestroy and appears on a single security blocklist. TLS is enabled via a certificate issued by a widely‑trusted public certificate authority, which masks traffic but does not mitigate the underlying malicious intent. Nameservers are hosted on centralnic.net infrastructure, a typical pattern for newly created abuse domains. Defenders should add the domain to outbound filtering rules, monitor DNS queries for related subdomains, and consider sinkholing the associated IP range. Users should be warned against any unsolicited requests to interact with cryptocurrency wallets or to approve transactions originating from this host, as the infrastructure appears purpose‑built to harvest private keys or redirect funds. Continuous re‑evaluation is advised, as the site may evolve beyond the default test page to host active drainer payloads.