claimecoearnmrewards[.]xyz

Analysis of claimecoearnmrewards.xyz indicates a confirmed crypto drainer operation, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to IP 104.21.50.140, hosted on Cloudflare's infrastructure (AS13335). Nameservers cesar.ns.cloudflare.com and nora.ns.cloudflare.com further confirm Cloudflare's role in its hosting environment. The SSL certificate, issued by Google Trust Services (WE1), aligns with common patterns observed in malicious domains leveraging reputable providers to evade detection. The domain's page title, 'Just a moment...', is consistent with Cloudflare's interstitial challenge pages, suggesting the site may have employed anti-bot measures or was in the process of loading malicious content.

Five of 93 security vendors on VirusTotal flagged the domain as malicious, reinforcing its classification as a crypto scam. It appears on one security blocklist and is explicitly blocked by PhishDestroy. The scam type, as identified in threat intelligence sources, is a crypto drainer, a scheme designed to siphon cryptocurrency from victims' wallets. Infrastructure analysis reveals no evidence of bulletproof hosting or anonymization beyond Cloudflare's standard services.

The domain's creation date, six months prior to the report, suggests it may have been part of a broader campaign, though no direct links to other domains or threat actors are currently documented. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network levels. Monitoring for re-activation or related domains registered through the same registrar (NiceNIC International Group Co., Limited) is recommended. Given its offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential future investigations.