reclaim-alliances[.]co

This domain, reclaim-alliances.co, is classified as a high-risk crypto drainer phishing site. Analysis indicates it is designed to deceive users into disclosing cryptocurrency wallet credentials by masquerading as a legitimate verification service, specifically targeting victims under the pretext of checking against lists of affected users. The page title, written in Russian, translates to 'Verification in lists of victims — Reclaim Alliance Co.,' suggesting a localized or region-specific targeting strategy. The threat posed involves unauthorized access to digital assets, leading to immediate financial theft upon credential submission.

Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on May 16, 2024, through DYNADOT LLC, a registrar frequently associated with phishing operations. It resolves to the IP address 104.21.9.198, a Cloudflare-protected endpoint commonly used to obfuscate hosting origins. Detection metrics further substantiate its malicious nature: 16 out of 95 security vendors on VirusTotal flag the domain, while it appears on three distinct security blocklists. The domain holds a Gridinsoft trust score of 0/100, reinforcing its classification as a high-confidence threat. Additional technologies detected include Facebook Pixel, cdnjs, Cloudflare Browser Insights, and HTTP/3, which may facilitate tracking, content delivery, and evasion of traditional security measures. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility.

Mitigation against crypto drainer threats requires a multi-layered approach. Users should immediately cease interaction with the domain and revoke any connected wallet permissions granted during prior visits. Wallet software providers are advised to preemptively block the domain and its associated IP address (104.21.9.198) within their threat intelligence feeds. Network-level protections should include DNS filtering to prevent resolution of reclaim-alliances.co and similar domains registered through DYNADOT LLC. Forensic analysis of affected systems should prioritize checking for unauthorized transactions or script injections tied to the domain’s unique seed identifier (92787c). Organizations are further encouraged to monitor for domains with identical page titles or Let’s Encrypt certificates registered within the same timeframe, as these may indicate copycat campaigns.