rendernetworkclaim[.]xyz

rendernetworkclaim.xyz was observed on July 24, 2026 as an offline domain that has been associated with a crypto‑drainer campaign. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers bryce.ns.cloudflare.com and dayana.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the generic page title “Just a moment…”, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS configuration despite the malicious intent.

Automated scanning on VirusTotal recorded five detections out of ninety‑three participating security vendors, confirming that at least a subset of scanners flag the domain as malicious. The domain also appears on a single external blocklist and has been actively blocked by the PhishDestroy service, further evidencing its classification as a crypto‑related scam. The observed technology stack consists of Cloudflare services, including Browser Insights and HTTP/3 support, which are typical for fast‑forwarding traffic and may be used to obscure the true origin of the malicious payload. While the available intelligence confirms the domain’s involvement in a crypto‑drainer operation, no payload samples, command‑and‑control endpoints, or victim interaction details have been published, leaving the exact infection vector and monetary theft mechanisms undefined.

Defenders should add rendernetworkclaim.xyz to URL filtering and endpoint protection rules, enforce blocklisting of the associated IP 188.114.96.3, and monitor for outbound connections to Cloudflare edge nodes that may be leveraged by the campaign. Continuous re‑scanning on multi‑engine platforms such as VirusTotal is recommended to capture any evolution in the threat profile.