claim-sandbox[.]club

Analysis indicates that claim-sandbox.club is an active crypto-drainer scam domain registered on March 11, 2026, through Dynadot LLC. The domain currently resolves to 188.114.96.3, an IP address assigned to AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (adelaide.ns.cloudflare.com, garrett.ns.cloudflare.com) and technologies including Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Let's Encrypt (serial E7), and the site returns an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial response that may obscure malicious content. Security vendors have flagged this domain as malicious, with 2 of 94 engines on VirusTotal detecting it at the time of assessment. The domain appears on at least one security blocklist and has been classified as a crypto scam by independent threat intelligence sources. The Gridinsoft trust score of 0/100 further supports its malicious classification. While the exact content of the site remains unconfirmed due to the 403 response, the available evidence—including the domain name, registration details, and detection by security tools—strongly suggests it is part of a crypto-drainer operation. Defenders should treat this domain as high-risk and implement blocking measures at the DNS or network level. Given its active status and association with Cloudflare infrastructure, monitoring for related domains or IP reuse may help identify additional threats. No legitimate use case has been identified for this domain, and users should be advised to avoid interaction.