claimbuy[.]pages[.]dev

On July 24, 2026 the domain claimbuy.pages.dev was observed as a high‑risk crypto drainer. The site is hosted behind Cloudflare and resolves to IP 188.114.97.3, belonging to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the authoritative nameservers emerie.ns.cloudflare.com and tim.ns.cloudflare.com. An HTTP request returns status code 403 and the page title reported by the server is “Suspected phishing site | Cloudflare”. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain.

The domain was created on October 30, 2025 through Cloudflare, Inc., and the infrastructure employs HSTS, HTTP/3 and Cloudflare’s edge network. Reputation checks show a Gridinsoft trust score of 0 out of 100. VirusTotal analysis recorded 11 detections out of 95 scanned engines, indicating malicious classification by multiple vendors. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service. Google Safe Browsing flags the site for social engineering, aligning with the reported crypto‑drain scam type.

Current monitoring indicates the domain has been taken offline, but the historical evidence suggests it was used to lure victims into transferring cryptocurrency. No further content was captured, so the exact phishing landing page or payload remains unknown. Defenders should continue to block the domain at network perimeter, update DNS blacklists, and monitor for any re‑registration or similar sub‑domains. Additional analysis of traffic logs for connections to 188.114.97.3 is advised, as well as the implementation of user awareness training regarding unsolicited crypto‑related requests.