claim[.]grvt[.]live

This domain, claim.grvt.live, is actively flagged as a high-risk crypto drainer targeting users through a fraudulent airdrop scheme. Registered on March 22, 2026, via NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 172.67.207.57, which is associated with Cloudflare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (earl.ns.cloudflare.com and laura.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt (serial number E8). The domain is hosted on Hostinger and employs HTTP/3, a configuration consistent with modern phishing campaigns aiming to evade detection. The page title, '$GRVT Airdrop,' explicitly indicates an attempt to impersonate a legitimate cryptocurrency airdrop, likely targeting holders of GRVT tokens or users interested in GRVT-related promotions. While the exact content of the site has not been analyzed, the classification as a 'Fake Airdrop' and 'Airdrop Scam' in available intelligence confirms its malicious intent. At the time of this report, the domain is blocked by at least one security vendor (PhishDestroy) and appears on one security blocklist. Gridinsoft assigns it a trust score of 0/100, further supporting its classification as malicious. Defenders should note that the domain remains active as of July 12, 2026, despite returning an HTTP 525 status, which may indicate SSL handshake failures or deliberate evasion tactics. The limited detection on scanning platforms (2 of 94 vendors on VirusTotal) suggests the campaign may still be in an early or evasive phase, or that the domain has not yet been widely disseminated. Given the high-risk classification and the use of a crypto drainer, organizations should prioritize blocking this domain at the DNS or network level, as well as monitoring for related indicators of compromise (IoCs) such as the IP address 172.67.207.57 and associated Cloudflare infrastructure.