claim-theoriq[.]xyz

The domain claim-theoriq.xyz was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently resolved to the IP address 104.21.75.38, which belongs to AS13335 operated by Cloudflare in the United States. The domain is served behind Cloudflare’s edge infrastructure, as indicated by the presence of Cloudflare Browser Insights, HTTP/3 support, and the nameservers quentin.ns.cloudflare.com and jean.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, and the site enforces HTTP Strict Transport Security, confirming a deliberate attempt to appear legitimate while masking the underlying host.

Analysis of threat intelligence shows that the site returns an HTTP 403 response and displays the page title "Just a moment...," a pattern commonly used by malicious pages that rely on Cloudflare’s JavaScript challenge to deter automated analysis. VirusTotal records indicate that 8 out of 95 security vendors have flagged the domain, and it appears on one external security blocklist. The Gridinsoft trust score of 0/100 and the classification of the campaign as a "cryptocurrency" scam further corroborate its role as a crypto‑drainer. The site has already been blocked by the phishing mitigation service PhishDestroy, reinforcing its active status as a high‑risk actor.

Defenders should prioritize immediate blocking of claim-theoriq.xyz at network perimeters and DNS resolvers, as well as monitoring for any outbound connections to the associated IP 104.21.75.38. Given the Cloudflare front‑end, deeper inspection of HTTP payloads behind the JavaScript challenge may be required to uncover the actual payload delivering the cryptocurrency theft. Continuous telemetry from threat feeds should be integrated to capture any future re‑hosting attempts, and incident response teams should advise users to avoid any unsolicited requests for crypto wallet credentials or transfers originating from this domain.