claim-klink[.]com

The domain claim-klink.com is currently marked as offline but exhibits multiple indicators consistent with a crypto drainer operation. It resolves to the Cloudflare IP address 104.21.70.79, which is registered to AS13335 in the United States, and uses the Cloudflare authoritative nameservers byron.ns.cloudflare.com and rachel.ns.cloudflare.com. Registration data shows the domain was created on October 26, 2025 through NiceNIC International Group Co., Limited, a registrar that frequently appears in threat actor infrastructure. The page title returned from the site, "KLINK Finance - Claim Your Rewards | Secure & Simple," aligns with the reported scam type of a crypto scam, suggesting an attempt to lure victims into submitting wallet credentials or transferring funds.

Four of ninety‑five security vendors on VirusTotal have flagged the domain, and it appears on a single security blocklist, specifically PhishDestroy. Additionally, Gridinsoft assigns the domain a trust score of zero out of one hundred, reinforcing the likelihood of malicious intent. No SSL certificate is present, meaning any traffic to the site would be unencrypted and susceptible to interception, a common characteristic of low‑effort fraud sites.

While the exact content of the site cannot be verified beyond the page title, the combination of detection counts, blocklist inclusion, registrar provenance, and hosting under a shared Cloudflare IP strongly indicates a malicious campaign targeting cryptocurrency users. Defenders should immediately block claim-klink.com at network perimeter and DNS filtering layers, monitor for any resolution of the associated IP address to detect possible replica infrastructure, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of the IP range and associated Cloudflare nameservers is advised, as the threat actor may repurpose the same hosting resources for future campaigns.