claim-cope[.]com

This domain, claim-cope.com, was registered on 29 August 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare address 104.21.5.139 (AS13335, United States). The site currently returns an offline HTTP status and presents no SSL certificate, indicating it is served only over plain HTTP. The page title reported is “$COPE”, and the threat classification is listed as a Crypto Scam, specifically a crypto‑drainer operation. Two of ninety‑five VirusTotal scanners flagged the domain as malicious, and the site is listed on two security blocklists, including PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0 / 100, reinforcing the low credibility of the host. Nameservers leonidas.ns.cloudflare.com and samara.ns.cloudflare.com confirm that the domain is behind Cloudflare’s CDN infrastructure.

Analysis shows that the infrastructure is typical of fast‑flux or temporary phishing sites that leverage Cloudflare’s edge network to hide origin details. The lack of an SSL certificate and the offline status suggest the campaign may be dormant or in transition, but the presence of detections and blocklist entries indicates that malicious activity was observed in the recent past. No additional intelligence such as OTX tags, Safe Browsing alerts, or payload samples is available, leaving the exact method of crypto‑draining (e.g., malicious smart‑contract injection or wallet address substitution) unconfirmed.

Defenders should continue to block the IP 104.21.5.139 at the network perimeter, add claim-cope.com to DNS‑sinkhole lists, and monitor for any re‑activation of the domain. Threat intel feeds should be updated to reflect the crypto‑drainer classification, and any future requests to resolve the domain should be redirected to a safe‑landing page. Continuous observation of Cloudflare‑associated IP ranges for similar patterns is recommended.