claimxyzverse[.]live

This domain, claimxyzverse.live, is identified as a crypto drainer site designed to siphon cryptocurrency assets from victims by exploiting wallet connection prompts. Analysis indicates no direct brand impersonation, but the infrastructure aligns with known drainer kit deployments, likely leveraging obfuscated JavaScript to execute unauthorized transactions. The page title 'Just a moment...' suggests a Cloudflare interstitial or anti-bot challenge, a common tactic to delay detection while filtering automated security scans.

Technical indicators confirm elevated risk: the domain is flagged by 6 out of 95 security vendors on VirusTotal, resolves to IP 104.21.16.37, and was registered through NiceNIC International Group Co., Limited on February 21, 2026. It appears on one security blocklist, and Google Safe Browsing (GSB) data is not explicitly listed, though the Cloudflare-backed infrastructure may obscure direct GSB classification. The SSL certificate is issued by Let’s Encrypt, a neutral but frequently abused provider in malicious campaigns.

Current status is offline, likely due to takedown or voluntary suspension. The domain was blocked by at least one security feed, and the HTTP/3 protocol usage suggests an attempt to evade traditional network-based detection. Despite its offline state, residual risk persists for users who may have interacted with the domain prior to deactivation. Organizations should monitor for related IOCs, including the IP and registrar details, and update endpoint protection to block wallet-draining scripts targeting similar infrastructure.