claimbonkfunrewards[.]xyz

Analysis of claimbonkfunrewards.xyz indicates a high‑confidence crypto‑drainer operation that was taken offline prior to the assessment date. The domain was registered on 21 August 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the A record 104.21.9.43 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers chance.ns.cloudflare.com and julissa.ns.cloudflare.com. No TLS certificate is presented, leaving the connection unencrypted. The HTTP response delivered a single HTML title “Just a moment…”, and no further content has been publicly disclosed.

Reputation data shows the domain appears on one security blocklist and is flagged by PhishDestroy. Gridinsoft assigned a trust score of 0 / 100, indicating a malicious classification. VirusTotal scans reported four of ninety‑five antivirus engines flagging the domain, corroborating the malicious assessment. The listed scam type is a crypto scam, consistent with the broader “crypto drainer” threat category.

Uncertainties remain regarding the exact payload, command‑and‑control infrastructure, or victim interaction flow, as no malware samples or URL paths have been captured. Defenders should block DNS resolution to 104.21.9.43, enforce HTTPS‑only policies, and add the domain to network‑level deny lists. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, as the attacker may migrate to alternative addresses within the same ASN. Incident response teams should also verify endpoint logs for any outbound connections to the domain before its takedown, and consider threat‑intel sharing with industry partners to improve early detection of related crypto‑drainer campaigns.