claims-campnetwork[.]xyz

The domain claims-campnetwork.xyz was registered on August 22 2025 through NameSilo, LLC. It is hosted on Cloudflare’s network, resolving to IP address 104.21.112.1 which is associated with AS13335 in the United States. The domain is configured with two Cloudflare nameservers, bristol.ns.cloudflare.com and ignacio.ns.cloudflare.com, and does not present an SSL certificate, indicating that HTTPS connections are not established. Gridinsoft assigned a trust score of 0 out of 100, reflecting a highly suspicious reputation. The only observed HTTP response was a page title of “Just a moment…”, a generic placeholder often used by automated redirection services, but no additional content has been captured. Threat intelligence classifies the site as a crypto‑drainer scam, a subset of broader crypto scams that attempt to exfiltrate digital assets from victims.

VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, and the domain appears on two public blocklists. Both PhishDestroy and ScamSniffer have listed the domain as blocked, reinforcing the assessment that it is being used for malicious purposes. The current operational status is offline; the site has been taken down, which limits immediate exposure but does not eliminate the risk of re‑deployment under the same or similar infrastructure. Uncertainty remains regarding the specific payload or phishing kit employed, as no sample pages or scripts have been retrieved. The lack of an SSL certificate prevents verification of any encrypted payloads, and the generic page title provides no insight into the victim‑facing experience.

Defenders should continue to monitor the domain’s DNS records for re‑activation and add the IP address 104.21.112.1 to blocklists where appropriate. Network‑level filters should also be configured to deny traffic to the associated Cloudflare nameservers for this domain.