claimnotifications[.]org

claimnotifications.org is a newly registered domain (creation date 8 September 2025) that was observed delivering a crypto‑drainer campaign. The site was hosted behind Cloudflare DNS (lana.ns.cloudflare.com, sevki.ns.cloudflare.com) and resolved to the IP address 216.150.1.1, which belongs to ASN 16509 operated by Amazon.com, Inc. and is geolocated in the United States. The registrar listed for the registration is Spaceship, Inc. No TLS certificate was presented, indicating the site was served over plain HTTP at the time of observation. The page title returned by the server was “ClaimNotify | Find & Reclaim Lost Money”, matching the advertised lure of a false money‑recovery service.

VirusTotal recorded a single positive detection out of ninety‑five security vendors, and the domain appears on one public blocklist, PhishDestroy. The current status is offline, and the domain has been removed from active hosting, but the infrastructure components remain observable. Evidence suggests the attacker leveraged reputable CDN services to obscure the origin of the traffic while directing victims to a malicious page that likely attempted to harvest cryptocurrency wallet credentials. Because the domain is already listed on a blocklist and has a known malicious detection, defenders should immediately deny any connections to 216.150.1.1 and to the domain name itself at the DNS level.

Monitoring of the Cloudflare nameservers for future updates is advisable, as the attacker could re‑activate the domain with new content. Adding the registrar Spaceship, Inc. to a watchlist may help identify related registrations. Given the single vendor flag, the threat level is elevated, and the presence on PhishDestroy confirms active abuse. Defenders should also consider updating any threat‑intelligence platforms with the domain, IP, and registrar metadata to improve cross‑organization visibility.