claiming-floki[.]app

PhishDestroy identifies claiming-floki.app as a recently activated domain linked to a suspected crypto drainer operation. This fraudulent site, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, was created on April 04, 2026, and currently remains live while evading detection by security engines with 1 out of 95 VirusTotal detections. The domain resolves to IP address 104.21.2.174 and operates under Cloudflare’s nameservers (rudy.ns.cloudflare.com, sima.ns.cloudflare.com), which are commonly abused by threat actors to obfuscate malicious infrastructure. This domain poses a direct financial threat to cryptocurrency users by potentially serving as a drainer that silently extracts digital assets from victim wallets during transaction signing. The lack of immediate detection despite active monitoring suggests either a newly deployed attack vector or one employing advanced evasion techniques. Given its recent registration and zero detection rate, the risk of exposure remains high, particularly for users engaging with DeFi platforms or Web3 services through this domain. Users who have visited claiming-floki.app should immediately disconnect any active wallet connections, revoke any granted permissions via wallet interfaces, and transfer remaining assets to a secure, offline wallet. Conduct a full malware scan on all devices used for crypto transactions and avoid reusing seed phrases or private keys. Report the domain to PhishDestroy and relevant blockchain security platforms like Etherscan’s phishing database to help disrupt this operation. Stay vigilant against unsolicited links and always verify domains against trusted blocklists before interacting.