claim-sapien[.]com

claim-sapien.com was first observed in security feeds as a crypto‑drainer site. The domain was registered on 06 Nov 2025 through NiceNIC International Group Co., Limited and points to the IP address 104.21.28.132, which belongs to Cloudflare’s AS13335 network located in the United States. DNS resolution uses the Cloudflare authoritative name servers mirа.ns.cloudflare.com and wesley.ns.cloudflare.com. No TLS certificate is presented, indicating the site operated over plain HTTP when it was reachable.

The page title returned by the server was the Hebrew phrase “רק רגע…”, translated as “Just a moment…”, a common placeholder used by many malicious landing pages. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis recorded a single positive detection out of 95 scanned engines, confirming that at least one vendor identified malicious behavior. Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating, reinforcing the suspicion of abuse.

The site’s status is currently listed as offline, suggesting that the operators have removed the content or the hosting has been taken down. Despite the takedown, the infrastructure remains observable: the Cloudflare front‑end continues to resolve the domain, and the underlying IP address is shared with other Cloudflare‑protected services, which may be leveraged for future campaigns. Defenders should continue to block the domain at perimeter filters, add the IP address to deny lists, and monitor for any re‑registration or reuse of the same name servers. Ongoing threat‑intel feeds should be consulted for new detections, and any internal alerts that reference the page title “רק רגע…” or the associated IP should be investigated as potential remnants of the crypto‑drainer operation.