bagsclaim[.]com

The domain bagsclaim.com was created on September 25, 2025 and is currently taken offline. DNS resolution points to the address 172.67.167.84, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is served by the Cloudflare nameservers nena.ns.cloudflare.com and nitin.ns.cloudflare.com. No SSL certificate is associated with the site, indicating that HTTPS was not configured at the time it was active. The page title observed during the brief window of activity was "$SOLB Airdrop Claim," matching the known phishing kit labeled as an Airdrop Scam and fitting the broader classification of a crypto scam.

Scamadviser assigned a trust score of 1 out of 100, while Gridinsoft gave a score of 0 out of 100, both reflecting extreme untrustworthiness. VirusTotal analysis recorded 13 detections out of 95 security vendors, and the domain appears on two independent security blocklists. It was also listed by PhishDestroy and ScamSniffer as a blocked resource. AlienVault OTX includes the domain in one threat‑intel pulse, further corroborating its malicious reputation.

Registration was handled by NiceNIC International Group Co., Limited, a registrar often associated with low‑cost registrations. The combined evidence—low trust scores, multiple vendor detections, blocklist inclusion, and the presence of an airdrop‑themed crypto drainer page—strongly indicates that bagsclaim.com was used to lure victims into submitting cryptocurrency credentials or private keys. Defenders should continue to block the domain and its associated IP address at perimeter filters, monitor for any resurgence of the same nameservers or IP range, and update threat‑intel feeds with the observed indicators. Analysts should also watch for newly registered domains using the same registrar or similar naming patterns, as the infrastructure may be re‑used in future campaigns.