claim-portalsfoundation[.]com

On July 22, 2026, claim-portalsfoundation.com was observed in an elevated‑risk brand‑impersonation campaign targeting Coinbase users with a fake airdrop lure. The domain was registered on 16 September 2025 through Web Commerce Communications Limited and resolves to the Cloudflare‑hosted address 104.21.112.1 (AS13335, United States). Cloudflare name servers april.ns.cloudflare.com and will.ns.cloudflare.com are authoritative for the zone. No TLS certificate is presented, indicating the site served only HTTP, which aligns with the absence of SSL and the low Gridinsoft trust score of 0 / 100. The site’s only visible metadata is the page title “Portals”, and the current HTTP response code is reported as offline, suggesting the landing page has been taken down.

Security‑vendor visibility includes a single detection on VirusTotal, where 1 of 95 scanners flagged the domain. Independent blocklist engines PhishDestroy and ScamSniffer have also listed the domain, and the domain appears on two additional security blocklists, reinforcing the assessment that it is being used for malicious purposes. No Safe Browsing, OTX, or additional vendor data were supplied. The campaign’s modus operandi is identified as a “Fake Airdrop” impersonating Coinbase, a pattern frequently leveraged to harvest credentials or crypto wallet details. While the exact payload or phishing page content has not been captured, the combination of a recently created domain, Cloudflare infrastructure, lack of TLS, and the presence on multiple blocklists is consistent with typical credential‑harvesting infrastructure.

Defenders should add claim-portalsfoundation.com to ingress and egress filtering rules, block DNS resolution at the recursive resolver level, and monitor for outbound connections to 104.21.112.1. Email security gateways should be updated to flag any communications referencing “Portals” or referencing Coinbase airdrop promises that originate from this domain.