claim-ellxlr[.]run

The domain claim-ellxlr.run is a phishing site designed to operate as a crypto drainer, a type of scam that targets cryptocurrency wallets by draining funds without the owner's consent. This site does not impersonate any known brand and no specific drainer kit has been identified in association with it. As of the latest verification, claim-ellxlr.run has been taken offline, though it previously posed an elevated risk to users who may have interacted with it.

Technical analysis of claim-ellxlr.run reveals limited detection by security vendors, with only 2 of 95 VirusTotal vendors flagging the domain, including Gridinsoft and Trustwave. The domain was created on February 21, 2026, and resolves to the IP address 104.21.13.153, hosted on Cloudflare's infrastructure (AS13335) in the US. It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by WE1. The observed page title was 'רק רגע...', and Google Safe Browsing has not flagged the domain at this time.

Users who may have interacted with claim-ellxlr.run should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer remaining funds to a new, secure wallet. It is also recommended to monitor wallet activity for unauthorized transactions. To report the domain, victims can submit it to platforms like PhishTank, Google Safe Browsing, or their local cybercrime authorities. Enabling two-factor authentication on all accounts and using hardware wallets for cryptocurrency storage can further reduce risk.