claims[.]humanitiy[.]xyz

The domain claims.humanitiy.xyz was created on February 21, 2026 and currently resolves to the IP address 104.21.15.149, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site’s HTML title is “Humanity Airdrop,” indicating the use of an airdrop‑style lure that is typical of cryptocurrency drainer campaigns. Intelligence sources identify the underlying infrastructure as the publicly known Airdrop Scam phishing kit, confirming the intent to harvest cryptocurrency credentials or private keys. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer, reinforcing its classification as a malicious resource.

VirusTotal analysis shows that three of ninety‑three scanning engines flagged the domain, providing additional vendor corroboration. The SSL certificate presented is labeled WE1, and the Gridinsoft trust score is 0 out of 100, both of which suggest a lack of legitimate security posture. The site is presently offline, limiting direct observation of payload behavior, but the collected artifacts are sufficient to establish a high confidence assessment of a crypto drainer operation with an elevated risk rating.

Defenders should immediately block any traffic to claims.humanitiy.xyz at the DNS, proxy, and firewall layers, and incorporate the associated IP address 104.21.15.149 into threat‑intelligence feeds. Continuous monitoring for re‑registration or similar domains leveraging the same kit is advised, along with updating detection signatures to capture the identified kit characteristics. Organizations handling cryptocurrency assets should also reinforce credential hygiene and educate users about unsolicited airdrop offers, as the domain’s tactics align with known social‑engineering vectors targeting crypto holders.