claims-apr[.]xyz

Analysis of claims-apr.xyz indicates active involvement in a high-risk crypto-drainer campaign as of July 12, 2026. The domain, registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to the IP address 104.21.40.12, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The domain's nameservers, may.ns.cloudflare.com and zac.ns.cloudflare.com, further confirm its reliance on Cloudflare's network, a common tactic to obscure hosting origins and evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), suggests the use of automated or low-cost certificate provisioning, consistent with large-scale phishing operations. Security vendors have flagged the domain, with seven out of ninety-five engines on VirusTotal detecting it as malicious. While this detection rate is not overwhelming, it aligns with the domain's presence on two security blocklists and its inclusion in one threat intelligence pulse on AlienVault OTX. The domain's HTTP status of 403, coupled with the page title 'Just a moment...', is characteristic of Cloudflare's interstitial challenge pages, often used to filter or delay access to malicious content. Technologies detected on the domain include HSTS, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to enhance perceived legitimacy or evade detection. The scam type is explicitly classified as a crypto scam, with no further details available regarding the specific mechanics of the drainer or targeted cryptocurrency platforms. The domain remains active, and its infrastructure shows no signs of disruption. Defenders are advised to block the domain and its resolving IP at the network level, monitor for related domains registered through the same registrar, and correlate with known crypto-drainer indicators of compromise. Further investigation into associated wallet addresses or transaction patterns is recommended to mitigate financial losses.