reclaimfees[.]xyz

This domain, reclaimfees.xyz, is flagged as a high-risk active crypto drainer phishing site. It was created on January 14, 2026, and remains operational as of July 12, 2026. The page title is 'SOL Reclaim', indicating a likely targeting of Solana blockchain users with a fake reclaim or fee refund scheme. VirusTotal reports 6 out of 95 security vendors flagging this domain, providing moderate but not universal detection. The domain appears on one security blocklist and is blocked by PhishDestroy. Infrastructure analysis reveals the site is hosted on Vercel, using Let's Encrypt SSL certificate issued by R13, and resolves to IP address 216.198.79.1 located in the United States under Lefkoff Industries. The HTTP response is a 307 redirect, common for phishing landing pages that quickly move victims to a malicious wallet connection prompt. The domain is registered through Name.com, Inc., with nameservers pointing to Vercel's DNS infrastructure. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The site employs HSTS for transport security, which is typical for legitimate services but can be abused to create a veneer of authenticity. Key uncertainties include the specific drainer kit used, the exact wallet addresses receiving stolen funds, and whether the campaign targets only Solana or other chains through redirects. No phishing kit vendor or brand has been identified from available data. Defenders should block this domain at DNS and email gateway levels, add the IP address 216.198.79.1 to blocklists, and monitor for related subdomains or variations. Users who may have visited this site should be warned to revoke any wallet permissions granted and to never connect their wallets to unknown sites. Continuous monitoring of Vercel-hosted phishing infrastructure and tracking of the 307 redirect chain may reveal additional associated domains.