claim-hyena[.]trade

The domain claim-hyhyena.trade (note: the correct spelling is claim-hyena.trade) is flagged as an active crypto‑drainer operation. The site presents a page title identical to its hostname, indicating no attempt to disguise the URL. DNS resolution points to 104.21.78.234, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are everton.ns.cloudflare.com and hadlee.ns.cloudflare.com, confirming that the domain is fully proxied through Cloudflare’s edge network. The infrastructure uses Cloudflare services and supports HTTP/3, suggesting a modern delivery stack that can obscure origin details.

The SSL certificate is issued by Google Trust Services under the WE1 intermediate, providing a valid HTTPS connection but offering no assurance of legitimacy. HTTP requests receive a 301 redirect response, a common tactic for funneling traffic to a malicious endpoint. Registration was performed through NiceNIC International Group Co., Limited on 11 December 2025, indicating a relatively recent creation date consistent with fast‑flux or short‑lived scam campaigns. The domain is classified as a crypto scam and specifically labeled a crypto drainer, aligning with the observed threat type. Independent security services have identified the domain as malicious: ten of ninety‑five VirusTotal scanners flag it, and it appears on at least one external blocklist.

PhishDestroy has also listed the domain as blocked, reinforcing the consensus of malicious intent. While the precise payload or wallet addresses targeted by the drainer are not disclosed in the available intelligence, the combination of a newly registered domain, Cloudflare‑proxied hosting, a valid but generic SSL certificate, and multiple vendor detections constitutes strong evidence of an active threat. Defenders should block all outbound connections to 104.21.78.234, add claim‑hyena.