smartchainsclaims[.]app

Analysis of smartchainsclaims.app shows a newly registered domain created on March 24, 2026 that is currently offline but was previously used for a crypto‑draining scam. The domain resolves to 172.67.149.97, an address owned by Cloudflare, Inc., and its DNS is served by the Cloudflare nameservers reese.ns.cloudflare.com and walk.ns.cloudflare.com. The site presented a generic page title "Just a moment..." and employed HSTS and HTTP/3, indicating a modern web stack, while the TLS certificate was issued by Let’s Encrypt (E8). Security‑vendor scans on VirusTotal recorded 2 detections out of 94 scanners, and the domain appears on a single public blocklist, where it was also flagged by PhishDestroy.

Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The registrar listed is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known provider used by threat actors for rapid domain turnover. Although the site is now taken offline, the combination of recent registration, low trust score, limited vendor detections, and presence on a phishing blocklist strongly suggests the domain was leveraged to lure victims into transferring cryptocurrency to attacker‑controlled wallets.

Uncertainty remains around the exact phishing flow, the specific cryptocurrency addresses targeted, and whether any additional infrastructure (e.g., command‑and‑control servers) is tied to the same IP range. Defenders should block the domain at DNS and proxy layers, monitor for any traffic to 172.67.149.97, and add the domain to internal blacklists. Incident response teams should also review logs for attempts to resolve or contact the domain after its creation date, and consider issuing an advisory to users warning against unsolicited crypto‑related requests originating from this URL.