claiming-shironeko[.]com

Analysis of the domain claiming-shironeko.com indicates it is associated with a crypto drainer phishing campaign, currently offline as of July 24, 2026. The domain was registered on December 25, 2024, through Web Commerce Communications Limited and utilizes Cloudflare nameservers (lex.ns.cloudflare.com and monroe.ns.cloudflare.com). Infrastructure analysis reveals resolution to IP 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate is present, and the page title observed during prior scans was 'Nur einen Moment…', suggesting a transient or intermediate loading state commonly used in phishing redirects. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, which classify it as a crypto scam.

Trust scores from Gridinsoft and ScamAdviser are both 0/100 and 1/100, respectively, reinforcing its malicious classification. While VirusTotal scans by 95 vendors returned no current detections, this absence does not confirm safety, as phishing domains often evade initial detection or are flagged post-compromise. The domain’s registration date, registrar, and hosting provider align with patterns observed in short-lived crypto drainer operations, though specific targeting or victim demographics remain unconfirmed. Defenders should treat this domain as high-risk for crypto-related fraud.

Blocklist integration at the network and endpoint levels is recommended, particularly for environments handling cryptocurrency transactions. Given its current offline status, monitoring for re-registration or DNS changes is advised. If historical traffic logs exist, review for connections to 188.114.96.3 or interactions with the domain during its active period. Further analysis of associated wallet addresses or redirect chains may provide additional indicators of compromise.