claim-towns[.]com

This domain, claim-towns.com, is flagged as an active cryptocurrency drainer infrastructure, operational since February 21, 2026. Analysis indicates the domain resolves to 172.67.214.116, an address hosted on Cloudflare's network (AS13335) in the United States. The site employs Cloudflare nameservers (louis.ns.cloudflare.com and veronica.ns.cloudflare.com) and is protected by a Google Trust Services SSL certificate issued under the WE1 intermediate. Current HTTP responses return a 308 status code, suggesting the domain may be redirecting visitors to another endpoint or maintaining a low-profile presence to evade detection. Infrastructure review reveals the domain was registered through Key-Systems GmbH and remains active as of July 12, 2026. Security vendor assessments show limited but consistent detection, with 3 out of 95 engines on VirusTotal flagging the domain. Additionally, the domain appears on two security blocklists, including PhishDestroy and ScamSniffer, which specialize in cryptocurrency-related threats. The page title, matching the domain name, offers no immediate indication of brand impersonation, though this does not preclude the use of dynamic content or cloaking techniques to present targeted lures. Defenders should prioritize monitoring and blocking this domain based on its association with cryptocurrency drainer activity. The use of Cloudflare services and HTTP/3 may complicate traditional network-based detection, requiring reliance on DNS-level blocking or endpoint protection measures. The domain's relatively recent creation and persistent activity suggest it is part of an ongoing campaign, though the specific targeting methods or victim demographics remain unclear. Organizations handling cryptocurrency transactions or managing digital asset wallets should treat this domain as high-risk and incorporate its indicators into threat intelligence feeds for proactive defense.