claimvitarewardsinu[.]sbs

Analysis of claimvitarewardsinu.sbs indicates that the domain is being used for a crypto‑drain scam. The site was registered on October 03, 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335, United States). The domain resolves to the IPv6 address 2606:4700:3037::ac43:b726 and uses the Cloudflare nameservers cody.ns.cloudflare.com and tara.ns.cloudflare.com. No TLS certificate is present, leaving traffic unencrypted. The page title observed during a brief fetch was "Pieni hetki...", which provides no further context about the payload.

Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1/100, Gridinsoft reports 0/100, and the domain appears on a single security blocklist. VirusTotal scans show 12 of 95 antivirus engines flag the domain, confirming malicious intent. PhishDestroy has already blocked the domain, and AlienVault OTX references it in one threat‑intel pulse. The classification from the intelligence feed lists the scam type as a crypto scam, aligning with the observed crypto‑drainer behavior.

What remains uncertain is the specific mechanism used to drain cryptocurrency—whether it involves malicious smart‑contract interaction, credential harvesting, or malware delivery—because the page content beyond the title has not been publicly disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for outbound connections to the associated IPv6 address, and enforce TLS inspection to detect any future encrypted payloads. Incident response teams should also correlate logs for any attempts to contact the domain from internal hosts and consider updating endpoint detection rules to flag the observed VirusTotal signatures. Continuous threat‑intel feeds should be consulted for any new indicators of compromise linked to this infrastructure.