alphabot-claim[.]app

The domain alphabot-claim.app is a phishing site that poses a specific threat as a crypto drainer. It was designed to trick users into claiming a fake $BOOST S1 Airdrop, potentially leading to the unauthorized transfer of cryptocurrency from their wallets. The site has been taken offline, but it remains important to be cautious as the threat may re-emerge.

alphabot-claim.app has been flagged by 2 of 95 vendors on VirusTotal, including G-Data and Gridinsoft, but it has not been flagged by Google Safe Browsing. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 94.181.203.96, which is located in Russia under the AS41727 JSC 'ER-Telecom Holding'. The site appears on 5 security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. It does not have an SSL certificate, and the nameservers are karl.ns.cloudflare.com and violet.ns.cloudflare.com.

If a user has interacted with alphabot-claim.app, they should immediately revoke any token approvals and move their cryptocurrency funds to a new, secure wallet. For those who may have entered login credentials, it is crucial to change passwords, enable two-factor authentication, and monitor accounts for any signs of unauthorized activity or fraud. Users can also report the domain to their preferred security blocklists and to the registrar, PDR Ltd. d/b/a PublicDomainRegistry.com, to help prevent further phishing attempts.