en[.]pop[.]claimnow[.]cc

This domain, en.pop.claimnow.cc, is identified as a crypto drainer infrastructure impersonating Telegram Access. The site is currently offline, though prior analysis confirms its use in cryptocurrency theft operations targeting users through deceptive Telegram-themed pages. No legitimate association with Telegram exists. Analysis indicates the domain was registered on April 18, 2026, through Cloudflare, Inc., and resolves to the IP address 172.67.206.77. It appears on one security blocklist and has been flagged by PhishDestroy, though VirusTotal reports 0 detections out of 95 vendors. The SSL certificate is issued by Google Trust Services, and the site employs Cloudflare and HTTP/3 technologies. Gridinsoft assigns a trust score of 0/100, reflecting high-risk classification. The domain is currently offline, but its infrastructure remains a potential threat. Organizations and users are advised to monitor for reactivation, block the domain and associated IP at network perimeters, and verify any Telegram-related promotions through official channels. Security teams should correlate this indicator with other crypto drainer campaigns for broader threat tracking.