usecorn-claim[.]com

On July 25, 2026 the domain usecorn-claim.com was observed as part of a crypto‑drainer campaign and subsequently taken offline. The domain was registered on February 21, 2026 through MAT BAO CORPORATION and resolves to the IP address 104.21.27.31, which is hosted by Cloudflare, Inc. (ASN 13335) in the United States. DNS resolution is served by the Cloudflare authoritative nameservers elijah.ns.cloudflare.com and elisabeth.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating the site employed HTTPS despite the eventual 522 timeout response captured in the page title "usecorn-claim.com | 522: Connection timed out".

VirusTotal analysis recorded a single positive detection out of 93 security vendors, and the domain appears on one external blocklist. Defensive feeds, including PhishDestroy, have already flagged the domain and it is listed on at least one public blocklist. The limited detection footprint suggests the infrastructure was short‑lived or narrowly targeted, but the presence of a Cloudflare edge node and a valid TLS certificate demonstrates a level of operational sophistication typical of crypto‑drainer actors.

Because the domain is currently offline, active mitigation focuses on pre‑emptive controls: network defenders should add 104.21.27.31 to deny‑list rules, enforce DNS filtering for the domain name, and monitor for any resurgence on the same IP range or Cloudflare‑hosted assets. Continuous telemetry from threat‑intel platforms should be consulted for possible re‑use of the registrar or nameserver pair in future campaigns. Evidence from the registration record, DNS configuration, SSL issuance, and the single vendor flag collectively substantiate the elevated risk rating and justify ongoing vigilance.