claimchain[.]pages[.]dev

This domain, claimchain.pages.dev, operates as a crypto drainer phishing site designed to compromise digital wallet credentials and siphon cryptocurrency assets. Analysis indicates the infrastructure is engineered to mimic legitimate wallet interfaces or transaction prompts, tricking users into authorizing malicious smart contract interactions or disclosing private keys. Once access is granted, funds are irreversibly transferred to attacker-controlled wallets, often within minutes of victim interaction. The threat is particularly acute for users of decentralized finance platforms or those engaging in token swaps, where transaction signing is frequent and expected. Evidence supporting this assessment includes detection by 15 out of 95 security vendors on VirusTotal, with the domain appearing on two independent blocklists: PhishDestroy and PhishingDB. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 26, 2025, and resolves to the IP address 172.66.47.171, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing campaigns leveraging free or automated certificate issuance. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has already flagged the content, though the domain remained active until recently taken offline. Users who visited claimchain.pages.dev or interacted with its content should immediately revoke any active wallet authorizations, particularly those related to token approvals or smart contract interactions. This can be done using blockchain explorers or wallet management tools to review and revoke suspicious permissions. Affected individuals should also transfer remaining assets to a new, secure wallet and monitor transaction histories for unauthorized activity. No sensitive information, such as seed phrases or private keys, should ever be entered on unverified platforms. Given the elevated risk of financial loss, victims are advised to report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities for further investigation.