claim-resolv[.]life

Analysis as of July 25, 2026 indicates that the domain claim-resolv.life is tied to a crypto‑drainer campaign. The domain was registered through PDR Ltd., operating as PublicDomainRegistry.com, and its creation date is recorded as March 07, 2026. DNS resolution points to the IP address 104.21.92.27, which belongs to AS13335 owned by Cloudflare, Inc., placing the host in the United States. Both authoritative nameservers are Cloudflare‑managed (sierra.ns.cloudflare.com and johnathan.ns.cloudflare.com), and the site serves content over HTTPS using a Let’s Encrypt certificate issued to the E7 profile. HTTP traffic is delivered via Cloudflare Browser Insights and HTTP/3, suggesting the use of Cloudflare’s performance and protection stack.

Static analysis shows the page title returned by the server is “Just a moment…”, but no further content has been captured. The domain has been scanned by 94 VirusTotal engines, none of which raised a detection at the time of scanning. Independent blocklist monitoring reports that claim-resolv.life appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The current operational status is offline, indicating that the site is no longer reachable. While the available data confirms the domain’s registration details, hosting infrastructure, SSL configuration, and blocklist presence, several aspects remain unknown.

No payload samples, redirection chains, or phishing landing pages have been publicly disclosed, and there is no evidence of associated command‑and‑control servers or wallet addresses. Consequently, the full scope of the crypto‑drainer operation cannot be quantified. Defenders should ingest the domain into internal blocklists, enforce DNS filtering for claim‑resolv.life, and monitor outbound traffic to the resolved IP 104.21.92.27 for anomalous cryptocurrency‑related communications.