intelligent-claim[.]zbrain[.]in

PhishDestroy identifies intelligent-claim.zbrain.in as an active crypto drainer domain under active investigation by fraud detection teams. This subdomain mimics a legitimate claims portal under the zbrain.in parent domain, suggesting a targeted campaign likely designed to deceive users expecting transaction confirmations or benefit payouts. The drainer kit in use appears to be a lightweight JavaScript-based payload designed to intercept and redirect cryptocurrency transfers to attacker-controlled wallets without user awareness. No specific brand impersonation has been confirmed at this time, but the use of a claims-related subdomain indicates potential abuse of trust in financial or administrative contexts.

Technical indicators confirm elevated risk: the domain resolves to IP 100.27.250.66, registered through GoDaddy on March 17, 2026, with a Let's Encrypt SSL certificate in place. VirusTotal currently shows 1/95 detection engines flagging the domain, indicating it remains under the radar of mainstream security tools. As of analysis, the domain is not flagged by Google Safe Browsing (GSB) and has not been added to major threat intelligence blocklists, though this may change rapidly given active investigation status. The domain's recent creation date and clean VT score suggest a newly deployed threat designed to evade early detection.

The domain remains active and under investigation, with fraud analysts monitoring for changes in behavior or infrastructure. While risk is assessed as high due to the presence of a crypto drainer payload and absence of detection, the lack of GSB or blocklist inclusion limits immediate remediation. Users are strongly advised to avoid visiting intelligent-claim.zbrain.in, verify all payment destinations via independent channels, and report any suspicious transactions involving this domain to their wallet provider or relevant authorities. Continued monitoring and proactive blocking by security teams are recommended to prevent further victimization.