banxchange[.]claims

Analysis of the domain banxchange.claims shows it was operating as a crypto‑drainer infrastructure before being taken offline. The site responded with HTTP status 200 and presented the page title "Connect Page". No SSL certificate was observed, indicating all traffic was unencrypted. DNS resolution pointed to IP address 192.3.190.186, which is registered to HostPapa (AS36352) and located in the United States.

The host runs LiteSpeed web server with HTTP/3 support, and the authoritative nameservers are dns1.webproserver.com and dns2.webproserver.com. An MX record exists for the domain itself (priority 0, host banxchange.claims), suggesting the attacker may have configured outbound mail capabilities. VirusTotal analysis recorded a single positive detection out of 95 scanning engines, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, and the current status is listed as offline.

Defenders should continue to block the domain and its resolved IP address at network perimeter and DNS filtering layers, ensuring that any cached entries are purged. Monitoring of other domains hosted on the same ASN (36352) or using the same nameserver pair is recommended, as threat actors often reuse infrastructure. Updating security appliances with the observed page title, server fingerprint (LiteSpeed, HTTP/3), and lack of TLS can improve detection of any re‑hosted copies. Incident response teams should also review mail logs for connections to the domain’s MX record to identify potential compromise attempts.