claimgems[.]site

This domain is flagged as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency from connected wallets. Victims are typically lured through phishing links or deceptive advertisements, where interacting with the site triggers unauthorized transactions. The attack relies on JavaScript-based scripts that execute in the background, draining funds without explicit user confirmation. Analysis indicates the domain was registered on October 12, 2025, through OwnRegistrar, Inc., and is currently offline. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious. Infrastructure analysis reveals it resolved to IP 104.21.91.11, used Cloudflare services, and employed HSTS and HTTP/3 protocols. The page title 'Nur einen Moment…' suggests an attempt to mimic a loading screen, likely to delay user awareness of the attack. If you visited claimgems.site or connected a wallet to it, immediately disconnect the wallet from all dApps and revoke any suspicious permissions. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Reset passwords for any accounts linked to the compromised wallet and enable multi-factor authentication where possible. Report the incident to relevant security teams for further mitigation.