claimendlessprotocolrewards[.]xyz

This domain, claimendlessprotocolrewards.xyz, has been identified as a crypto‑drainer infrastructure. Registration records show it was created on 16 August 2025 via NiceNIC International Group Co., Limited. The authoritative nameservers arvind.ns.cloudflare.com and rosemary.ns.cloudflare.com indicate the zone is hosted on Cloudflare’s network; DNS resolution points to IP 104.21.38.89, which belongs to AS13335 Cloudflare, Inc., and geolocates to the United States. No TLS certificate is presented, so the site was reachable only over HTTP. The single observed page returned the title “Nur einen Moment…”, which matches the limited intelligence collected.

Threat‑intelligence feeds report that the site was blocked by PhishDestroy and currently appears offline. Static analysis on VirusTotal shows that 4 of 95 antivirus engines flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The domain is listed on one security blocklist, reinforcing its reputation as a malicious resource. Defenders should treat any DNS resolution of claimendlessprotocolrewards.xyz as hostile. Immediate actions include adding the domain and its resolved IP address (104.21.38.89) to network deny lists, updating endpoint and web‑gateway filters to block the URL, and monitoring for any future re‑registration or movement to alternative IP ranges under the same Cloudflare ASN.

Because the site is hosted on a shared CDN, blocking the entire ASN may cause collateral impact; therefore, rule‑based blocking at the domain level is preferred. Continuous monitoring of Cloudflare‑hosted domains that share the same nameserver pattern is advisable, as threat actors frequently rotate addresses while retaining the same registration details. Analysts should also watch for new TLS certificates issued for this domain, which could indicate a re‑activation.