claims-kintara[.]com

Analysis of the domain claims-kintara.com indicates it is an active crypto drainer threat, first observed on July 15, 2026, and currently unresolved. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals Cloudflare nameservers (kip.ns.cloudflare.com and meera.ns.cloudflare.com) and resolution to the IP address 188.114.97.3, a Cloudflare-hosted endpoint. The SSL certificate is issued by Google Trust Services, a common but not inherently malicious provider, and the site employs HTTP/3, a protocol often used to evade detection. Detection data shows the domain is flagged by at least three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in cryptocurrency-related threats. VirusTotal reports that 4 of 95 security vendors classify the domain as malicious, though this count does not represent exhaustive validation. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, suggesting the site may be concealing its true content behind a proxy or awaiting activation. Defenders should treat claims-kintara.com as a high-risk domain due to its registration context, detection by specialized crypto threat feeds, and association with a known scam type (crypto drainer). Organizations are advised to block the domain at the DNS or network level and monitor for connections to the IP 188.114.97.3. While the exact content of the site remains unanalyzed, the combination of registrar, hosting infrastructure, and detection by cryptocurrency-focused security tools strongly supports its classification as an active threat. Further investigation into the domain's activity post-July 15, 2026, is recommended to assess its operational status and potential impact.