claimgoldtoken[.]com

Analysis of claimgoldtoken.com, registered on September 03, 2025 through NiceNIC International Group Co., Limited, shows that the domain was actively hosting a crypto‑drainer campaign before being taken offline. The authoritative nameservers are nitin.ns.cloudflare.com and surina.ns.cloudflare.com, indicating reliance on Cloudflare’s CDN. DNS resolution points to 104.21.48.1, an address owned by AS13335 Cloudflare, Inc. and located in the United States. The site presented the page title “GOLD Club”, and the TLS certificate was issued by Google Trust Services / WE1, confirming a legitimate certificate chain.

HTTP/3 support was observed, further confirming Cloudflare’s involvement. Security‑vendor scans on VirusTotal recorded three positive detections out of ninety‑five scanners, and the domain appears on the PhishDestroy and ScamSniffer blocklists. The risk rating has been marked as elevated. As of the report date, July 24, 2026, the domain is offline, but the infrastructure components – Cloudflare edge, the IP address, and the registrar – remain reusable for future malicious sites.

Defenders should continue to block the IP 104.21.48.1 and the domain itself, monitor any re‑registration of the name, and add the associated nameservers to allow‑list or deny‑list policies as appropriate. Additional investigation is needed to determine whether the underlying content used a specific cryptocurrency wallet or smart‑contract address, as that information was not captured in the available intelligence. Until the domain is fully retired, enterprises should maintain strict outbound controls on traffic to Cloudflare‑served IP ranges that are not explicitly required, and update web‑filtering rules to reflect the current blocklist entries.