listas[.]claims

Analysis of the domain listas.claims shows multiple indicators of malicious activity consistent with a crypto‑draining scam. The site was registered on February 21, 2026 and is presently taken offline, but historical data remain relevant for threat‑hunting. DNS resolution points to IP address 216.198.79.1, which geolocates to the United States and is owned by Lefkoff Industries. The hosting infrastructure does not appear to be shared with legitimate services, raising the likelihood of a dedicated malicious server.

The SSL certificate presented by the site is identified as R13, a certificate that lacks a recognized public‑trust chain and is commonly observed on fraudulent domains. The page title returned from the site is "$LISTA Airdrop," and the underlying code matches the publicly catalogued Airdrop Scam phishing kit, confirming the use of a known airdrop‑themed lure to entice cryptocurrency victims. VirusTotal analysis records a single positive detection out of 93 scanning engines, indicating at least one vendor has identified malicious behavior. Independent blocklist feeds list the domain on two security blocklists, and it has been explicitly blocked by the PhishDestroy and ScamSniffer filtering services.

These multiple independent detections reinforce the assessment that the domain is part of a coordinated crypto‑drain operation. Defenders should continue to block listas.claims at the DNS and proxy layers, monitor outbound connections to its resolved IP, and flag any internal traffic that attempts TLS handshakes with the R13 certificate. Since the site is currently offline, threat actors may re‑host the payload elsewhere; therefore, security teams should also watch for the Airdrop Scam kit signatures and similar page titles in future incidents. Continuous re‑query of VirusTotal and blocklist sources is advised to capture any new detections that could indicate re‑activation of the infrastructure.