claimclctsrewards[.]xyz

The domain claimclctsrewards.xyz was created on February 21, 2026 and is currently listed as taken offline. It resolves to the IP address 104.21.64.1, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. The SSL certificate presented for the site is identified as WE1, indicating a valid TLS handshake but offering no assurance of legitimacy. The page title returned by the web server is "Just a moment...", a generic placeholder that provides no indication of the site’s purpose.

The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy service. VirusTotal analysis shows that four of ninety‑three security vendors have flagged the domain, suggesting a modest level of consensus among detection engines that the site is malicious. The listed scam type is "Crypto Scam," consistent with the elevated risk rating assigned to the domain. No additional intelligence such as registrar details, Safe Browsing verdicts, or OTX identifiers is available.

Analysis indicates that the infrastructure relies on Cloudflare’s CDN, which can obscure the true origin server and complicate takedown efforts. Defenders should immediately block the domain and its associated IP address at perimeter defenses, update intrusion detection signatures to include the observed page title and SSL fingerprint, and monitor for any resurgence of the domain or reuse of the IP range for similar crypto‑drainer campaigns. Continuous observation of threat‑intel feeds for new detections related to claimclctsrewards.xyz is recommended, as the current evidence suggests the domain was part of a short‑lived malicious operation that may reappear under a different label.