claim[.]naoriprotocol[.]xyz

On July 24, 2026 analysts observed that the domain claim.naoriprotocol.xyz is associated with a brand‑impersonation campaign targeting the generic "across" brand. The site’s HTML title resolves to "Naoris Token", indicating a possible focus on cryptocurrency assets. The domain was registered on February 21, 2026 and is hosted behind the Cloudflare network (AS13335) at the IP address 104.21.14.77, which geolocates to the United States. An SSL certificate labeled WE1 is present, but the certificate’s validation details have not been disclosed. The domain is currently offline, and its last known status is marked as taken offline.

Threat intelligence feeds have recorded the domain on a single security blocklist; PhishDestroy has explicitly blocked it. Independent trust‑scoring services rate the domain poorly: Gridinsoft assigns a score of 6 out of 100, while Scamadviser gives a rating of 1 out of 100, both reflecting a high likelihood of malicious activity. VirusTotal analysis shows that two of ninety‑five scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent. The campaign is classified as a crypto scam, and the associated brand target is listed as "across," though no further details about the impersonated brand’s assets are available. Given the limited public exposure and the domain’s current offline state, definitive conclusions about the exact phishing payload or user‑interaction mechanisms cannot be drawn.

Nevertheless, the convergence of low trust scores, blocklist inclusion, and vendor detections justifies a heightened defensive posture. Security teams should continue to monitor the domain’s DNS resolution for any re‑activation, enforce outbound filtering to block traffic to the associated IP address, and incorporate the domain hash into threat‑intel feeds. Organizations using brand‑specific email filters should add claim.naoriprotocol.xyz to blacklists to prevent inadvertent credential harvesting.