claimallevm-rewards[.]top

PhishDestroy identifies claimallevm-rewards.top as an active crypto drainer domain impersonating Webee 3’s blockchain infrastructure. Threat actors leverage a fake “Webee 3 – Secure, Scalable, Decentralized Blockchain Infrastructure” landing page to trick cryptocurrency users into connecting wallets and authorizing malicious drainer scripts. No publicly known drainer kit signature has been released yet, but the page title and branding alignment suggest a targeted impersonation rather than a generic template. This domain was flagged by VirusTotal with a score of 1/95 security vendors as of the latest scan. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, a resolution to IP 188.114.96.3, and a creation date of April 15, 2026. It appears on two major blocklists and is blocked by MetaMask and SEAL, indicating early industry recognition. The presence of a Let’s Encrypt SSL certificate adds a veneer of legitimacy while obscuring malicious intent. As of now, claimallevm-rewards.top remains active and unremediated by the domain owner. Immediate defense includes blocking the domain at network and endpoint levels using the IP and domain hash 35ea49. Users are advised to avoid interacting with Webee 3-related links outside official channels and to verify blockchain infrastructure domains via official documentation. Remaining risk is high due to active deployment and lack of takedown, warranting continued monitoring and proactive blocking.