claim-t3rn[.]pages[.]dev

As of July 24, 2026, the domain claim-t3rn.pages.dev is flagged as a crypto drainer phishing site. The domain has been taken offline and currently returns an HTTP 403 Forbidden status when accessed. This indicates that the site is no longer active, although the infrastructure and potential vectors remain relevant for further analysis. The domain appears on one security blocklist, which suggests it has been used in malicious activities. The page title 'BRN to TRN Claim' indicates it may have been part of a cryptocurrency-related scam, possibly targeting users attempting to claim or transfer tokens.

The domain is registered through Cloudflare, Inc., and was created on February 21, 2026. Infrastructure analysis reveals the use of HSTS (HTTP Strict Transport Security), Cloudflare services, and HTTP/3, which are common in modern web configurations. The SSL certificate is issued by Google Trust Services, providing an additional layer of trust that could be exploited by attackers to gain user confidence. The IP address 188.114.96.3 is located in the United States and is associated with Cloudflare's network (AS13335). The nameservers for this domain are savanna.ns.cloudflare.com and todd.ns.cloudflare.com.

The Gridinsoft trust score for this domain is 0 out of 100, indicating a high level of distrust. The domain is blocked by PhishDestroy, further reinforcing its status as a known threat. Defenders should remain vigilant and monitor for any resurgence of activity on this domain, as well as ensure that users are aware of the risks associated with crypto drainer scams and the importance of verifying the authenticity of any cryptocurrency-related sites before engaging. The exact content and operational details of the site are not yet analyzed, but the evidence strongly suggests it was used for phishing purposes, particularly targeting cryptocurrency users.