app-claiming[.]xyz

The domain app-claiming.xyz is currently active and hosted on an AWS Global Accelerator endpoint located in the United States. DNS resolution points to IP 76.223.54.146, and the authoritative nameservers are ns5.afternic.com and ns6.afternic.com. The domain is registered through GMO Internet Group, Inc. d/b/a Onamae.com and presents a GoDaddy TLS Intermediate CA DV certificate (R1v1). Intelligence sources list the domain in two AlienVault OTX pulses and three external blocklists, and it has been flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows five of ninety‑one security vendors flag the domain as malicious. The listed threat type is a crypto drainer, indicating the site likely attempts to illicitly transfer cryptocurrency assets. No public page content or detailed payload information is available, so the exact mechanism of the drain remains uncertain. Defenders should add the domain and its resolving IP to network‑level deny lists, ensure TLS inspection policies capture traffic to the GoDaddy certificate chain, and monitor for anomalous outbound cryptocurrency transactions originating from internal hosts contacting this address. Continuous threat‑intel feeds should be consulted for any updates to the associated OTX pulses or additional detection signatures.