claim-jewish[.]pages[.]dev

PhishDestroy identifies claim-jewish.pages.dev as an active cryptocurrency-draining campaign posing as a Jewish community claims portal. This domain is currently categorized as a crypto_drainer and is under active investigation for direct theft of digital assets from unwitting users. The threat involves malicious JavaScript payloads designed to intercept and divert outgoing wallet transactions to attacker-controlled addresses, resulting in irreversible fund losses. This domain was flagged after being detected on 2 independent security blocklists and blocked by SEAL and MetaMask. It resolves to IP 172.66.47.138 and uses a Let’s Encrypt SSL certificate. Registered through Cloudflare, Inc., the domain shows 0 detections out of 95 on VirusTotal as of the latest scan, indicating evasion of automated detection engines. The low detection rate suggests the campaign is either newly launched or carefully engineered to bypass signature-based defenses. While the exact creation date is not publicly available, the active presence on multiple threat intelligence feeds confirms ongoing malicious operations. To mitigate exposure to this crypto_drainer, users should immediately block access to claim-jewish.pages.dev at the network and endpoint levels. Block the associated IP 172.66.47.138 and domain via firewall rules or DNS sinkholing. Users interacting with cryptocurrency platforms should verify destination URLs manually, use hardware wallets for high-value transactions, and enable transaction simulation tools when available. Always cross-check domains against threat intelligence platforms before entering private keys or signing transactions. Report any suspicious transactions to wallet providers and law enforcement immediately.