claim[.]merklfi[.]one

This domain, claim.merklfi.one, is identified as a crypto drainer phishing endpoint designed to compromise cryptocurrency wallets by tricking users into authorizing malicious transactions or disclosing private keys. Analysis indicates the site employs social engineering tactics, such as fake token claims or airdrop scams, to lure victims into interacting with fraudulent smart contracts or wallet-draining scripts. The infrastructure is tailored to exploit users of decentralized finance (DeFi) platforms, particularly those associated with the legitimate MerkleFi ecosystem, by mimicking its branding and functionality. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on April 23, 2026, through NameSilo, LLC, and currently resolves to the IP address 188.114.96.3. It holds a Gridinsoft trust score of 0/100, and VirusTotal reports that 15 out of 95 security vendors flag the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as it is commonly used by both legitimate and malicious sites to encrypt traffic and evade basic detection. Users who visited claim.merklfi.one or interacted with its content should immediately revoke any active wallet authorizations associated with the domain. This can be done via blockchain explorers or wallet interfaces that support token approval revocation. Affected individuals should also monitor their wallets for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected. No further interaction with the domain or its associated links should occur, and users are advised to report the domain to their wallet provider or relevant security teams for further investigation.