claimrehearewardsfi[.]xyz

The domain claimrehearewardsfi.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the Cloudflare edge address 104.21.95.156, which is hosted in the United States under ASN 13335 (Cloudflare, Inc.). The domain uses Cloudflare‑provided nameservers adam.ns.cloudflare.com and anahi.ns.cloudflare.com and presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint at the time of observation. The page title returned by the HTTP request is "Just a moment...", a generic placeholder that offers no insight into page content.

Gridinsoft’s trust scoring engine assigned a score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that five of ninety‑three scanning engines flagged the domain, confirming a subset of security vendors consider it suspicious. The site appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. Detected web technologies include Cloudflare Browser Insights, the core Cloudflare service layer, and HTTP/3 support, all of which are typical for fast‑content delivery but do not mitigate the underlying threat.

The intelligence categorises the activity as a crypto scam, specifically a crypto drainer, although the exact mechanism (e.g., wallet address extraction, transaction redirection) has not been observed. Uncertainties remain regarding the payload delivered, the extent of victim interaction, and any command‑and‑control infrastructure beyond the Cloudflare edge. Defenders should continue to block the domain at network perimeter devices, add the associated IP range to reputation‑based deny lists, and monitor for any re‑registration attempts.