claim-ethana[.]pages[.]dev

Analysis of claim-ethana.pages.dev shows that the domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare edge address 172.66.44.176, located in the United States under AS13335. The authoritative name servers are adi.ns.cloudflare.com, karl.ns.cloudflare.com, miles.ns.cloudflare.com and zita.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site serves an HTTPS endpoint signed by Google Trust Services / WE1 and enforces HTTP Strict Transport Security. HTTP/3 is also enabled, and the server returns HTTP 403 responses with the page title “Just a moment…”.

The domain appears on two security blocklists and has been actively blocked by PhishDestroy and ScamSniffer, indicating that it has been identified as a malicious resource. VirusTotal scans report that two of ninety‑three security vendors flagged the domain, and Gridinsoft assigns a trust score of zero out of one hundred, both reinforcing the suspicion of abuse. The listed scam type is “Crypto Scam,” which aligns with the elevated risk rating of “crypto drainer”. No additional content or behavior has been observed because the service is currently offline.

At present, the concrete evidence consists of the registration details, hosting in a Cloudflare network, the restrictive HTTP response, the blocklist listings, and the low trust scores from multiple vendors. What remains uncertain is the exact payload or transaction mechanism that would have been used to drain cryptocurrency, as no live page content or network traffic is available for analysis. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑appearance of the same name servers or IP address, and add the domain to internal threat intelligence feeds. Ongoing observation of Cloudflare‑hosted assets associated with the same IP or ASN is recommended, as adversaries often reuse infrastructure after takedown.