claim-hunt[.]com

This domain, claim-hunt.com, is actively flagged as a high-risk cryptocurrency drainer operation. Analysis indicates the site was registered on March 15, 2026, through Global Domain Group LLC and currently resolves to the IP address 104.21.53.44, hosted behind Cloudflare infrastructure in Canada. The domain is blocked by multiple security providers, including PhishDestroy, MetaMask, and SEAL, and appears on three distinct security blocklists. While the HTTP response returns a 403 status with the page title 'Just a moment...', this behavior is consistent with Cloudflare-protected phishing pages attempting to evade detection or restrict access to non-targeted visitors. Technical indicators reveal the use of Cloudflare nameservers (ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com) and HTTP/3 protocol, suggesting an attempt to leverage modern web technologies for obfuscation. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. Despite the 403 response, the domain remains operational, and its inclusion in security vendor detections—with 3 out of 95 engines flagging it on VirusTotal—reinforces its classification as a crypto drainer threat. Defenders should treat this domain as actively malicious and prioritize blocking it at the network and endpoint levels. The combination of Cloudflare hosting, cryptocurrency-themed scam classification, and multi-source blocklisting indicates a deliberate attempt to target users with wallet-draining attacks. Given the domain's recent registration and ongoing activity, monitoring for related infrastructure—such as newly registered domains under the same registrar or IP range—may help identify additional threats. No legitimate use case has been observed for this domain, and its infrastructure aligns with known patterns of crypto drainer campaigns.