claim-rlusd[.]top

On July 24, 2026, the domain claim-rlusd.top was observed hosting a page titled “RLUSD — Claim Your Allocation”. The site was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 19 May 2026 and is served from the Cloudflare edge address 188.114.96.3, using the nameservers addilyn.ns.cloudflare.com and arvind.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (subject E7) and the server enforces HSTS while offering HTTP/3, confirming the presence of Cloudflare’s security stack. VirusTotal records ten of ninety‑one scanning engines flagging the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist.

Gridinsoft assigns a trust score of zero out of one hundred, and the overall risk rating is listed as high. The site’s current status is offline, which suggests that the operators have taken it down or that mitigation actions have succeeded. Analysis indicates the domain is being used as a crypto‑drainer, likely attempting to persuade victims to submit private keys or transfer tokens under the pretense of claiming an “RLUSD” allocation. The page title is the only visible artifact; no further content has been captured, leaving the exact lure and credential‑collection mechanisms unconfirmed.

Nonetheless, the combination of a newly‑registered domain, Cloudflare hosting, a Let’s Encrypt certificate, and multiple vendor detections aligns with typical infrastructure employed by crypto‑draining campaigns. Defenders should add claim-rlusd.top and its resolving IP 188.114.96.3 to network‑level deny lists, enforce DNS filtering that respects the Google Safe Browsing and PhishDestroy entries, and monitor for any resurgence of the domain or similar “claim‑allocation” patterns. Continuous re‑scanning of the domain, especially if it reappears, will be necessary to capture any changes in payload or hosting configuration.