claim-dexrp[.]org

This domain is flagged as a high-risk crypto drainer, a threat type designed to siphon cryptocurrency from victim wallets by exploiting malicious smart contracts or wallet-draining scripts. Analysis indicates the site employs deceptive prompts to trick users into authorizing transactions that transfer funds to attacker-controlled addresses. The threat is classified as severe due to its direct financial impact and the irreversible nature of blockchain transactions. Infrastructure analysis reveals the domain was registered on March 24, 2026, through Dynadot Inc, an uncommon creation date that may indicate an attempt to evade detection. It resolves to IP address 172.67.129.148 and is hosted behind a Google Trust Services SSL certificate, which provides a false sense of legitimacy. The domain is detected by 15 out of 95 security vendors on VirusTotal and appears on four security blocklists, including those maintained by wallet protection and anti-phishing systems. Gridinsoft assigns a trust score of 0/100, further confirming its malicious intent. The page title 'Just a moment...' is consistent with cloaking techniques used to delay or obscure malicious content from automated scanners. Mitigation requires immediate action from both end users and network defenders. Users who may have interacted with the domain should revoke any active wallet authorizations via blockchain explorers or dedicated revocation tools. All connected sessions should be terminated, and wallet software reinstalled if compromise is suspected. Network administrators are advised to block the domain and its resolving IP at the perimeter. Security teams should monitor for outbound connections to 172.67.129.148 and correlate logs for wallet connection attempts. Given the domain's current offline status, defenders should remain vigilant for re-registration or migration to new infrastructure under similar naming conventions.