claudeagent[.]fun

This domain, claudeagent.fun, is flagged for brand impersonation targeting cryptocurrency users through a fraudulent airdrop registration scheme. Analysis indicates the site mimics legitimate token distribution platforms, presenting itself as 'ClaudeAgent — Airdrop Registration' to deceive victims into disclosing wallet credentials or transferring funds. No specific drainer kit has been identified yet, but the page structure and branding suggest a typical airdrop scam infrastructure designed to harvest sensitive information. Infrastructure analysis reveals the domain resolves to IP address 216.198.79.65 and was registered through Name.com, Inc. on May 14, 2026. The SSL certificate is issued by Let's Encrypt, providing a false sense of security. As of the latest scan, VirusTotal reports 0/95 detections, indicating the domain has not yet been widely flagged by security vendors. Google Safe Browsing status is currently unlisted, and no blocklist entries have been recorded. The Gridinsoft trust score of 0/100 further corroborates the malicious intent. The domain remains active and under investigation, with no takedown or sinkholing actions observed. Users are advised to treat any interaction with claudeagent.fun as high-risk and avoid entering credentials or connecting wallets. Organizations should monitor for connections to 216.198.79.65 and consider preemptive blocking of the domain across security gateways. Given the lack of detections, reliance on traditional blocklists may not suffice; proactive threat hunting and endpoint monitoring are recommended to mitigate exposure.