claims-common[.]org

The domain claims-common.org was observed on July 25, 2026 as part of a crypto drainer campaign. The domain resolves to 172.67.206.205, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was detected, indicating that the site was served over plain HTTP or that encryption was not configured at the time of analysis. The site’s HTML title is reported as “Nur einen Moment…”, a German phrase meaning “Just a moment…”, which is commonly used by malicious pages to delay user interaction. Registration information shows that the domain was created on October 27, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative nameservers are kaiser.ns.cloudflare.com and teresa.ns.cloudflare.com, both hosted by Cloudflare.

Reputation services flag the domain as high‑risk. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that six of ninety‑five scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. AlienVault OTX lists the domain in one threat‑intel pulse, and it appears on a single security blocklist that has taken it offline. PhishDestroy also listed the domain as blocked.

The current status is reported as offline, preventing further live interaction. The evidence points to a deliberately crafted crypto‑draining operation, yet the exact payload or victim‑interaction flow remains unverified because the page content has not been captured beyond its title. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration of the same name, and consider adding the IP address 172.67.206.205 to threat‑intel feeds. Additional analysis should be performed if the domain reappears, focusing on payload delivery mechanisms and any associated command‑and‑control infrastructure. Until further data is available, the domain should be treated as malicious and excluded from trusted lists.