rizzmas-claim[.]xyz

Analysis of the domain rizzmas-claim.xyz indicates that it was actively used as a crypto‑drainer before being taken offline. The domain was registered on 12 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare’s network (AS13335) with the address 188.114.96.3, which resolves to a US location. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a valid HTTPS certificate despite the malicious intent. The domain appears on four independent security blocklists and has been flagged by the anti‑phishing services PhishDestroy, MetaMask, ScamSniffer and SEAL.

VirusTotal scans show that five of ninety‑one security vendors reported the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high‑risk assessment. Nameserver records point to casey.ns.cloudflare.com and rita.ns.cloudflare.com, both owned by Cloudflare.

The current status is offline, preventing further interaction, but the historical evidence suggests a coordinated campaign targeting cryptocurrency wallets. Uncertainty remains regarding the exact phishing kit or the full scope of victim outreach, as no page title or content analysis is available. Defenders should continue to block the domain at network perimeters, monitor for related IP or certificate reuse, and update threat‑intel feeds with the registrar and DNS details to mitigate any resurgence.