claims[.]tvrtle[.]xyz

This domain, claims.tvrtle.xyz, is identified as a crypto drainer, a type of threat that stealthily siphons cryptocurrency from users' wallets. The site poses a significant risk as it can execute malicious scripts to drain funds without the user's knowledge or consent.

Analysis indicates that claims.tvrtle.xyz is flagged by 12 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain was created on October 20, 2025, and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. Despite these red flags, the domain has been taken offline, and its current status is offline. The IP address it resolved to, 104.21.19.47, is located in the United States and is associated with AS13335 Cloudflare, Inc. The page title displayed by the domain was 'Just a moment...', which is often used to mask the true nature of the site while it loads malicious content.

If a user has visited claims.tvrtle.xyz, they should immediately check their cryptocurrency wallets for any unauthorized transactions. It is also recommended to scan their system for malware using a reputable security solution and change any associated passwords or access credentials. Users should be vigilant and avoid clicking on links from unknown sources to prevent exposure to similar threats.