claim-ariaprotocol[.]xyz

This domain, claim-ariaprotocol.xyz, is actively impersonating Drift, a cryptocurrency platform, as part of a high-risk scam operation. Registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP address 188.114.96.3, which is part of AS13335 (Cloudflare, Inc.) located in the US. Analysis indicates the domain is currently active, returning an HTTP 403 status with a page title of 'Just a moment...', a common response from Cloudflare-protected infrastructure when access is restricted or under review. Infrastructure analysis reveals the use of Cloudflare technologies, including HSTS, Cloudflare Browser Insights, and HTTP/3, alongside nameservers pearl.ns.cloudflare.com and huxley.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a typical configuration for domains leveraging Cloudflare’s proxy services. Despite the HTTP 403 response, the domain appears on five security blocklists, and five out of ninety-five security vendors on VirusTotal flag it as malicious, specifically in the context of cryptocurrency scams. Additional blocking by tools such as PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura further corroborates its classification as a brand impersonation threat. What remains uncertain is the exact mechanism of the scam, as the HTTP 403 status may indicate either a temporary restriction or a deliberate evasion tactic to avoid automated detection. The domain’s creation date, four months prior to this report, suggests it was established with the intent to deceive users over an extended period. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level, particularly in environments where cryptocurrency-related activity occurs. Monitoring for related domains using similar naming conventions or infrastructure patterns is recommended, as this may indicate a broader campaign targeting Drift users.