claim[.]inkfi[.]one

This domain, claim.inkfi.one, is identified as a crypto drainer phishing site designed to compromise cryptocurrency wallets by tricking users into authorizing malicious transactions. Analysis indicates no direct association with a legitimate brand, though it likely impersonates decentralized finance (DeFi) platforms or token airdrop campaigns to lure victims. The infrastructure aligns with known crypto drainer kits, which automate the theft of digital assets by exploiting wallet connection prompts and signature requests. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.209.28 and was registered through NameSilo, LLC on April 17, 2026. It is flagged by 3 out of 95 security vendors on VirusTotal, appears on one security blocklist, and holds a Gridinsoft trust score of 0/100. The site employed a Let's Encrypt SSL certificate, a common tactic to create a false sense of security. Despite being registered in 2026, the domain exhibited active malicious behavior shortly after creation, suggesting premeditated fraudulent intent. As of the latest assessment, claim.inkfi.one has been taken offline, likely due to detection and reporting by security entities. However, residual risk remains due to potential rehosting under a different domain or IP. Users who interacted with the site should immediately revoke any wallet authorizations, transfer assets to a new wallet, and monitor transaction histories for unauthorized activity. Organizations are advised to update blocklists with the domain and IP to prevent future access attempts.