claim[.]calderafoundations[.]life

The domain claim.calderafoundations.life was observed to host a crypto drainer operation before being taken offline. Infrastructure analysis shows the domain resolving to the IP address 172.67.189.63, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration data indicates the domain is provisioned through Cloudflare, Inc., without an accompanying SSL certificate, suggesting the site was served over plain HTTP. The page title returned by the server was "Nur einen Moment…", a German phrase meaning "Just a moment…", which is consistent with a brief holding page often used in malicious redirects.

VirusTotal records show that two out of ninety‑five scanning engines flagged the domain, providing independent confirmation of malicious activity. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation platform, reinforcing its classification as a threat. The listed scam type is a Crypto Scam, aligning with the observed behavior of a crypto drainer that attempts to exfiltrate cryptocurrency assets from victims.

Although the site is currently offline, the retained evidence of its DNS resolution, registration pathway, and detection history should be incorporated into threat‑intel feeds. Defenders are advised to continue monitoring the associated IP address for any re‑use, ensure that outbound connections to the IP are restricted where appropriate, and update URL filtering rules to include claim.calderafoundations.life. The limited detection footprint underscores the importance of sharing this indicator with peer security communities to improve collective awareness of emerging crypto‑drainer campaigns.