claimsyours[.]pages[.]dev

The domain claimsyours.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.66.46.245 located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS handshake despite the underlying malicious intent. The HTTP response returned a 403 status code at the time of analysis, and the site is currently offline. Threat intelligence classifies the domain as a crypto‑drainer operation employing wallet or seed phishing techniques. The page title returned “Whiterock”, which does not correspond to any known legitimate brand and suggests a placeholder or decoy site.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and received a Gridinsoft trust score of 0 out of 100, reinforcing its malicious reputation. VirusTotal records show the domain was scanned by 93 AV engines, none of which raised a detection. The lack of alerts does not constitute validation of safety and should be weighed against the other indicators. Nameserver records list miki.ns.cloudflare.com and bob.ns.cloudflare.com, both Cloudflare‑managed, which is consistent with the registration details.

No public samples of the phishing landing page, credential‑harvesting forms, or malicious payloads have been released, so the exact content and lure mechanisms remain unverified. Defenders should proactively block the domain and its associated IP range in network perimeters, add the host to URL filtering lists, and monitor for new domains that resolve to the same Cloudflare IP or share the same nameserver pattern. Continuous re‑scanning on platforms such as VirusTotal is advised, as the site may be re‑activated. Incident response teams should treat any wallet‑seed disclosures linked to this domain as compromised and advise affected users to rotate credentials immediately.