claims-mind[.]app

The domain claims-mind.app was observed hosting a crypto‑drainer operation and has been taken offline as of the report date, July 24 2026. Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers fay.ns.cloudflare.com and oswald.ns.cloudflare.com and resolves to the address 104.21.80.1, which belongs to Cloudflare’s AS13335 network located in the United States. No TLS certificate is presented; HTTPS connections are terminated without a valid certificate, indicating the site was likely served over plain HTTP or with an invalid certificate. The HTTP response returned the page title “Just a moment…”, which provides no additional context about the payload or intended victim interaction. Reputation data indicate the domain has been added to a single security blocklist and received a trust score of 0 out of 100 from Gridinsoft, reflecting a high likelihood of malicious intent.

PhishDestroy has also flagged the domain, and the registrar listed is OwnRegistrar, Inc., a service often used for rapid, low‑cost registrations. VirusTotal scanned the domain with 95 AV engines but did not emit any detections; this absence should not be interpreted as evidence of benign behavior, especially given the explicit crypto‑drainer classification in the intelligence feed. The available evidence confirms the domain’s association with a crypto‑scam campaign, yet the exact lure, victim‑targeting method, and any embedded wallet addresses remain unknown because the site content has not been captured. Consequently, analysts cannot determine whether the site employed a copy‑paste wallet‑drain kit, a malicious smart‑contract, or a social‑engineering page designed to solicit private keys.

Defenders should continue to block claims-mind.app at perimeter and DNS layers, monitor for any resurgence of the domain or its IP address, and add the associated IP range to threat‑intel feeds.