propyreward[.]claims

This domain, propyreward.claims, is flagged as an active crypto drainer infrastructure targeting users through a fake airdrop scheme. Registered on March 27, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain exhibits multiple indicators of malicious intent. Infrastructure analysis reveals Cloudflare-hosted nameservers (quincy.ns.cloudflare.com and journey.ns.cloudflare.com) and a resolution to IP 188.114.96.3, geolocated in Canada under Cloudflare’s network. The domain currently returns an HTTP 403 status, suggesting restricted access or defensive measures to evade detection while maintaining operational readiness. Security vendor assessments further corroborate the threat classification. As of July 12, 2026, six out of ninety-five security engines on VirusTotal have flagged the domain, and it appears on at least one security blocklist. AlienVault OTX records show the domain in eight distinct threat intelligence pulses, indicating recurring malicious activity. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate certificates are frequently abused to lend credibility to phishing domains. The specific scam type—fake airdrop—aligns with common crypto drainer tactics, where victims are lured into connecting wallets to fraudulent platforms under the guise of token distributions. While the domain’s current HTTP 403 response may indicate temporary downtime or evasion, its continued resolution and active threat intelligence references confirm ongoing risk. Defenders should treat this domain as hostile and prioritize blocking at the DNS or network level. Monitoring for related subdomains or IP shifts is recommended, as threat actors often rotate infrastructure to sustain operations.