xyzverse-claim[.]io

This domain, xyzverse-claim.io, is flagged as an active crypto drainer operation as of July 12, 2026. Registered on November 4, 2025, through NiceNIC International Group Co., Limited, the domain remains unresolved by many security vendors but has been detected by four out of ninety-five engines in public scans. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3 protocol, with an SSL certificate issued by Google Trust Services, resolving to the IP address 104.21.75.18. The domain is currently listed on two security blocklists and appears in twenty-three threat intelligence pulses, indicating persistent tracking by multiple threat-sharing platforms. The page title 'Just a moment...' suggests the domain may employ evasion techniques or dynamic content loading, though the exact nature of the site's content remains unverified. Given its classification as a crypto drainer, the domain likely targets users through deceptive prompts designed to authorize malicious blockchain transactions, though no specific brand or platform impersonation has been confirmed. The domain's trust score is zero, reinforcing its high-risk status, and it is actively blocked by at least two security filters. Defenders should treat this domain as a confirmed threat vector for cryptocurrency theft. Immediate action includes blacklisting the domain and its resolving IP in perimeter security controls, as well as monitoring for any outbound connections to 104.21.75.18. While the domain's registration details and hosting provider are known, attribution to a specific threat actor or campaign remains uncertain. Additional analysis of associated wallet addresses or transaction patterns may provide further context, though such data is not currently available in public feeds. The domain's continued activity despite partial detection underscores the need for layered defenses against crypto-related fraud.