crusader-claimable[.]click

The domain crusader-claimable.click was registered on June 03, 2026 through Namecheap. DNS resolution points to the Cloudflare‑owned address 172.67.155.3, which Geo‑locates to Canada and is served by the nameservers gina.ns.cloudflare.com and tanner.ns.cloudflare.com. The site presents an HTTP 302 redirect and serves a TLS certificate issued by Google Trust Services (WE1), indicating a valid HTTPS endpoint. Fingerprint analysis shows the presence of Bootstrap, Nginx and HTTP Strict Transport Security (HSTS) headers. The page title returned by the server is “Telegram: Launch @hellj_bot”, linking the site to a Telegram brand impersonation campaign. Threat intelligence classifies the activity as a crypto‑drainer scheme targeting Telegram users. Five of ninety‑one VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100. The domain is currently listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Available evidence confirms that the infrastructure is fully operational and that the site is being used to lure victims under the guise of a Telegram launch bot. No additional page content has been captured, so the exact payload or credential‑harvesting mechanism remains unknown. Defenders should immediately add crusader-claimable.click to URL filtering and DNS block lists, monitor for related C2 IP activity, and enforce TLS inspection to capture any subsequent redirects. Continuous re‑evaluation is advised as the site may evolve its payload or hosting configuration.