claimsrecovery[.]ru

claimsrecovery.ru is currently active and serves HTTP 200 responses with the page title “Главная”. The domain resolves to 195.208.1.158, an address assigned to AS48287 JSC RU‑CENTER in Russia. Registration data shows the domain was created on 21 December 2001 through RU‑CENTER‑RU, and the authoritative name servers are ns3‑l2.nic.ru, ns4‑cloud.nic.ru, ns4‑l2.nic.ru, ns8‑cloud.nic.ru and ns8‑l2.nic.ru. The site presents a valid GlobalSign GCC R3 DV TLS certificate issued by GlobalSign nv‑sa, indicating encrypted HTTPS connections. Security telemetry flags the domain as a crypto‑drainer with a high risk rating. VirusTotal recorded a single positive detection out of 95 scanned engines, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one public blocklist and is listed by PhishDestroy as blocked. The known scam type is a crypto scam, but no additional content analysis (e.g., lure pages or wallet addresses) is publicly available, so the exact mechanism of fund extraction remains unverified. Defenders should block network traffic to 195.208.1.158 and add claimsrecovery.ru to URL filtering and DNS sinkhole rules. Monitoring for outbound connections to the IP and for any attempts to resolve the domain is recommended. Because the SSL certificate is valid, TLS inspection may be required to detect malicious payloads. Continuous re‑scanning with multiple AV engines is advised to capture any new detections. Awareness of the domain’s long registration age and Russian hosting can aid attribution efforts.