claim-nodes[.]web[.]app

On 24 July 2026, claim-nodes.web.app was observed hosting a crypto‑drainer campaign. The domain is registered with Google LLC and resolves to the Fastly edge address 199.36.158.100, which is announced by ASN 54113 and located in the United States. TLS termination is provided by Google Trust Services under the WR4 certificate, and the site enforces HSTS while supporting HTTP/3, indicating use of modern Firebase‑hosted infrastructure. An HTTP request to the root URL returns a 404 status code, and the page title reported by scanners is “Decentralized Protocol F”, a generic reference that does not reveal the targeted brand or service.

The domain is listed on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intelligence feeds have identified it as malicious. VirusTotal analysis shows that ten of ninety‑five scanners flag the domain, reinforcing the suspicion of malicious activity. Nameserver records point to ns‑cloud.googledomains.com, consistent with Google’s DNS service.

The available evidence confirms that claim‑nodes.web.app is part of a high‑risk crypto‑drainer operation, but the exact payload, victim interaction flow, and any associated command‑and‑control endpoints remain unknown because the site returns only a 404 response and no payload was captured. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the Fastly IP range, and include the four blocklist entries in their threat‑feed aggregation. Continuous re‑scanning is advised in case the site becomes active again, and any related hashes or URLs observed in network traffic should be correlated with the known certificate and IP attributes.