claim-bitcoinos[.]xyz

Analysis of claim-bitcoinos.xyz shows a clear cryptocurrency‑related impersonation campaign targeting the Bitcoin brand. The site was registered on October 28, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline, as indicated by the status flag. DNS resolution points to 104.21.29.95, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain uses Cloudflare’s default nameservers huxley.ns.cloudflare.com and pearl.ns.cloudflare.com, and no SSL certificate was observed, meaning HTTPS connections would fail or be unencrypted.

The only visible HTML title is "Just a moment...", providing no further context about the page’s purpose. Threat intelligence lists the domain as a crypto scam that impersonates Bitcoin, and it appears on at least one security blocklist, with PhishDestroy explicitly marking it as blocked. VirusTotal scans report that eight of ninety‑five antivirus and URL‑reputation engines flagged the domain, reinforcing the malicious classification. Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion.

Defenders should immediately add claim-bitcoinos.xyz to network and endpoint blocklists, enforce DNS filtering, and consider blocking the associated Cloudflare IP range if broader mitigation is required. Continuous monitoring of the IP address for any re‑activation is advised, as threat actors often rotate hosting while retaining the same infrastructure. Because the site lacks TLS, any attempted connections would be downgraded to HTTP, which can be detected via proxy logs. Organizations should also review any outbound traffic to Cloudflare edge nodes for anomalous request patterns that could indicate a resurgence of this campaign.