defiapp-claim[.]xyz

The domain defiapp-claim.xyz was first registered on 14 November 2025 through NiceNIC International Group Co., Limited. Its authoritative name servers are ns13.v-sys.org and ns14.v-sys.org, and it resolves to the IPv4 address 95.214.235.117, which is allocated to Virtual Systems LLC in Ukraine (AS30860). No TLS certificate is presented, meaning the site operated only over HTTP and could have exposed any submitted data to interception.

VirusTotal analysis shows that fourteen of ninety‑five scanning engines flagged the domain as malicious, and the site appears on two independent blocklists, PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The HTTP response returned a page title of “Defi App”, a generic label that aligns with the reported crypto‑scam type, but no further content was captured because the host was taken offline before deeper inspection could occur.

Because the site is no longer reachable, detailed indicators such as form fields, redirects, or payloads could not be collected, leaving the exact technique used to drain cryptocurrency assets unverified. Defenders should block traffic to both the domain and its resolved IP address at perimeter and DNS layers, and monitor for newly registered domains that use the same registrar or similar name‑server patterns. Incident response teams should treat any credential or wallet address submissions to this domain as compromised, advise affected users to revoke any authorizations and move funds to secure wallets, and consider the infrastructure as an elevated‑risk crypto drainer that may be re‑hosted elsewhere.