claim-mmtfinance[.]xyz

Analysis of claim-mmtfinance.xyz shows a recent domain created on 21 February 2026 and immediately pointed at Cloudflare’s network (AS13335, United States). The A-record resolves to 188.114.96.3, which is owned by Cloudflare, Inc. The domain is served behind Cloudflare’s DNS infrastructure using the nameservers louis.ns.cloudflare.com and veronica.ns.cloudflare.com. The site returns HTTP 403 and the page title reported by automated crawlers is “Suspected phishing site | Cloudflare”, indicating that the content has been flagged by Cloudflare’s own protection services. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, a common certificate for sites using Cloudflare’s SSL proxy. Reputation data is uniformly negative. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating.

VirusTotal records five detections out of ninety-three scanning engines, and the domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer. Both blocklists classify the site as a crypto‑related scam, matching the supplied “Crypto Scam” label and the broader “crypto drainer” threat type. The registrar information shows the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in malicious registrations. The combination of a brand‑new registration, Cloudflare‑hosted IP, low trust score, multiple vendor detections, blocklist listings, and the “Suspected phishing site” page title provides strong circumstantial evidence that claim‑mmtfinance.xyz is being used to lure victims into a crypto‑draining scheme. No additional content has been captured because the site is currently offline, preventing further behavioural analysis. Consequently, the precise phishing workflow, targeted wallets, or victim interaction patterns remain uncertain.

Defenders should treat the domain as malicious.