claim[.]aimanak[.]co

The domain claim.aimanak.co is currently active and classified as a high‑risk crypto drainer. It was registered on December 07, 2025 through Web Commerce Communications Limited and resolves to the IP address 172.67.160.118, which belongs to AS13335 operated by Cloudflare, Inc. The domain’s authoritative nameservers are anirban.ns.cloudflare.com and cass.ns.cloudflare.com, indicating that the infrastructure is fully proxied behind Cloudflare’s edge network and is reachable via HTTP/3. An initial HTTP 301 redirect is observed, after which the final page title returned is “404 Not Found”. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate authority despite the malicious intent.

Detection telemetry shows that two of ninety‑three VirusTotal security vendors have flagged the domain, and it appears on two external blocklists, specifically PhishDestroy and ScamSniffer. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of malicious behavior. No additional public threat‑intel feeds (such as OTX or Safe Browsing) are referenced in the supplied data, so the broader attribution of the campaign remains uncertain. Defenders should prioritize immediate blocking of claim.aimanak.co at perimeter and DNS filtering layers, given its confirmed association with a crypto‑draining scam.

Continuous monitoring of outbound connections to the Cloudflare‑hosted IP 172.67.160.118 is advised, as the same infrastructure may be reused for other malicious payloads. Organizations should also update internal threat‑intel repositories with the domain’s creation date, registrar, and SSL details to aid correlation with future indicators. Because the site returns a 404 page title after redirection, automated content‑inspection tools may miss the malicious payload; therefore, heuristic and reputation‑based controls are recommended.