claim-layerzero[.]events

The domain claim-layerzero.events was observed targeting the LayerZero brand through a crypto‑focused impersonation campaign. Technical inspection shows the domain resolves to 104.21.77.115, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are donovan.ns.cloudflare.com and dora.ns.cloudflare.com, indicating use of Cloudflare DNS. No TLS certificate is presented; HTTP connections terminate without encryption. The page title returned during the brief scrape was “Nur einen Moment…”, a German phrase meaning “Just a moment…”, which does not reveal any brand‑specific content.

The site was registered via OwnRegistrar, Inc., and no further WHOIS details are disclosed. VirusTotal scans recorded nine positive detections out of ninety‑five vendors, confirming that multiple security engines recognize the domain as malicious. It appears on at least one public blocklist and has been added to the PhishDestroy blocklist, reinforcing its classification as a known threat. Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of malicious intent. The domain is currently taken offline, limiting immediate exposure, but the infrastructure—Cloudflare hosting, public blocklist listings, and the crypto scam tag—suggests it could be re‑activated quickly.

Uncertainties remain regarding the exact payload delivered to victims; the page content beyond the title has not been captured, and no SSL certificate prevents analysis of potential HTTPS‑only redirects. Analysts should continue to monitor the domain for re‑appearance, enforce DNS‑level blocking of the domain and its associated IP, and add the host to intrusion‑detection signatures. Because the domain leverages Cloudflare’s shared infrastructure, defenders should also consider broader network‑level controls that limit outbound connections to Cloudflare‑served IP ranges when unexpected.