claim-stream[.]quest

Analysis of claim-stream.quest shows that the domain was registered on September 27, 2025 through ERANET INTERNATIONAL LIMITED. The authoritative nameservers arnold.ns.cloudflare.com and ligia.ns.cloudflare.com resolve the domain to IP address 104.21.59.196, an address owned by AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented for the host, indicating that connections are served without encryption. The page title returned when the site was reachable was "QUEST", and the threat classification in the intelligence feed is a crypto drainer scam.

VirusTotal reports that 12 of 95 scanning engines flagged the domain as malicious, and the domain appears on two external blocklists. Additional detection is confirmed by PhishDestroy and ScamSniffer, both of which have listed the domain as blocked. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence in malicious intent. AlienVault OTX includes the domain in a single threat‑intelligence pulse, further corroborating its use in illicit activity.

The current status is offline, so active content cannot be inspected, and the lack of an SSL certificate prevents a direct assessment of any credential‑harvesting pages that may have existed. Defenders should continue to block the domain at perimeter and DNS layers, monitor the ERANET INTERNATIONAL LIMITED registrar for newly observed registrations that reuse the same naming pattern, and consider the associated Cloudflare IP range as potentially hostile when observed in conjunction with similar threat indicators. Ongoing vigilance is recommended because the absence of active hosting does not preclude future re‑use of the same registration details for new campaigns.