claim[.]grvtio[.]xyz

The domain claim.grvtio.xyz was registered on March 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently reported as offline. Technical inspection shows the domain resolves to the IP address 172.67.181.76, which belongs to Cloudflare, Inc. and is geolocated to Canada. The authoritative nameservers listed are earl.ns.cloudflare.com and laura.ns.cloudflare.com, indicating that the site leveraged Cloudflare's DNS and CDN services. No TLS certificate was observed for the domain, meaning that HTTPS connections would be unavailable or would fall back to an unencrypted HTTP channel.

The page title retrieved from the site was "$GRVT Airdrop," aligning with the classified scam type of a crypto drainer that attempts to lure victims with a fabricated airdrop offering. VirusTotal analysis recorded eight positive detections out of ninety‑four scanned security vendors, confirming that multiple threat intelligence feeds recognize the domain as malicious. The domain appears on a single security blocklist and is explicitly listed as blocked by the PhishDestroy service, providing an additional corroborating signal of its malicious intent. Infrastructure fingerprints indicate the presence of Hostinger and Cloudflare Browser Insights technologies, as well as support for HTTP/3, which are typical of many abuse‑hosting setups.

While the site is presently offline, the combination of registrar information, Cloudflare‑hosted IP, lack of encryption, and the observed detection counts suggest a deliberate attempt to distribute a crypto‑drainer kit. Defenders should add claim.grvtio.xyz to blocklists at the network perimeter, enforce DNS sinkholing for the domain, and monitor traffic to the associated Cloudflare IP for any residual activity. Since the domain’s content cannot be inspected further, ongoing vigilance for similar patterns—such as the "$GRVT Airdrop" title and use of Cloudflare nameservers—will aid in early identification of related campaigns.