claimfunds[.]site

Analysis of claimfunds.site as of July 24, 2026 indicates that the domain is associated with a crypto‑draining operation. The site presented the page title "ClaimFunds.US - Recover Your Unclaimed Money," which aligns with the recorded scam type of a crypto scam. The domain was created on July 21, 2025 and is hosted on the IP address 185.158.133.1, which resolves to a Cloudflare network (AS13335) located in Poland. Nameserver records point to ns1.dns-parking.com and ns2.dns-parking.com, typical of parking services rather than a legitimate content host.

No SSL certificate was observed, meaning traffic is unencrypted and vulnerable to interception. The registrar listed is HOSTINGER operations, UAB, a provider frequently used by malicious actors for rapid domain provisioning. The domain appears on a single security blocklist and has been blocked by the PhishDestroy mitigation service, confirming that defensive tooling has identified the site as malicious. VirusTotal scanned the domain with 95 vendors and reported no detections; while this suggests that known signatures did not flag the site, the absence of detections does not constitute evidence of safety.

The current status shows the site taken offline, which may be a temporary takedown or an operational pause by the threat actor. Uncertainty remains regarding the exact infrastructure used to harvest cryptocurrency credentials and whether additional domains share the same hosting footprint. Defenders should continue to block the domain at network perimeter, monitor the associated IP for any resurgence, and add the domain to internal blacklists. Analysts are advised to watch for new registrations that reuse the same nameservers or IP range, and to consider threat‑intel sharing of this indicator with partners to improve early detection of related campaigns.