claim-pup[.]site

Analysis of the domain claim-pup.site indicates a recent registration (07 Oct 2025) through the Hostinger operations, UAB registrar. The domain resolves to the IP address 198.18.2.135 and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No TLS certificate is presented, meaning the site is reachable only over HTTP, which is consistent with many malicious drop‑off points that avoid encryption to simplify traffic inspection. The threat profile is identified as a crypto‑drainer scam; the classification appears in the supplied intelligence as “Crypto Scam”.

Four of ninety‑five VirusTotal scanners have flagged the domain, providing independent indication of malicious intent. Additionally, the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one defensive vendor has taken mitigation steps. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100), reinforcing the assessment of high risk. The current operational status is listed as offline, which may indicate that the malicious payload has been removed or that the operators have temporarily suspended activity.

However, the underlying infrastructure—static IP, parking nameservers, lack of SSL—remains in place and could be re‑activated. Defenders should continue to block claim-pup.site at DNS and proxy layers, monitor the associated IP address for any future hosting changes, and incorporate the domain into threat‑intel feeds. Because the site currently returns no content, any future HTTP response should be examined for redirects or credential‑harvesting pages. Ongoing vigilance is advised, as the domain’s recent creation date and low trust score suggest it may be part of a broader campaign targeting cryptocurrency users.