turtleclaims[.]xyz

The domain turtleclaims.xyz is currently active and has been classified as a crypto drainer. The site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.147.93 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers isabel.ns.cloudflare.com and ricardo.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. HTTP requests return a 403 status code, and the page title observed is “Even geduld…”, which does not provide further context about the payload.

Automated analysis by VirusTotal shows that five of ninety‑three scanners flagged the domain, and the site appears on a single external blocklist. It has also been listed by PhishDestroy and receives a Gridinsoft trust score of zero out of one hundred, reflecting a high confidence of malicious intent. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, consistent with the underlying CDN infrastructure. Evidence confirms that the domain is being used to lure victims into cryptocurrency‑related scams, specifically targeting users for illicit fund transfers. However, the exact phishing page content, payment addresses, or victim interaction flow have not been publicly disclosed, leaving the precise attack vector uncertain.

Defenders should block DNS resolution for turtleclaims.xyz, add the IP 172.67.147.93 to network‑level deny lists, and enforce URL filtering based on the observed blocklist entries. Monitoring of TLS certificates issued by Google Trust Services for this domain may provide early warning of re‑registration attempts. Continual re‑scanning with VirusTotal and inclusion in endpoint protection rules is advised, given the existing detection ratio and the zero trust score.