reclaimed-value[.]store

This domain, reclaimed-value.store, is identified as an active crypto drainer designed to siphon cryptocurrency from compromised wallets. Analysis indicates the site employs malicious JavaScript to intercept and exfiltrate wallet credentials, a common tactic in crypto-draining campaigns. No specific brand impersonation is observed, but the infrastructure aligns with known drainer kits used in recent wallet-draining attacks targeting decentralized finance (DeFi) platforms. Infrastructure analysis reveals the domain was registered on June 17, 2026, through GoDaddy.com, LLC, and resolves to the IP address 15.197.148.33. The SSL certificate is issued by GoDaddy TLS Intermediate CA DV - R1v1, a common provider for both legitimate and malicious domains. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on 3 security blocklists. The domain is currently not listed in Google Safe Browsing (GSB) but is blocked by multiple wallet security providers and threat intelligence feeds. As of the latest assessment, reclaimed-value.store remains active, posing a high risk to users interacting with cryptocurrency wallets or DeFi platforms. Immediate response actions include blocking the domain at the network level, revoking SSL certificates associated with the IP, and alerting users to avoid interaction. Despite existing blocklist entries, the domain continues to operate, underscoring the need for continuous monitoring and proactive mitigation to prevent credential theft and financial loss. Users are advised to verify wallet addresses, employ hardware-based authentication, and avoid connecting wallets to unverified websites.