claim-asteroid[.]pages[.]dev

PhishDestroy identifies claim-asteroid.pages.dev as an active crypto drainer domain luring victims with deceptive wallet connection prompts to siphon cryptocurrency assets. The page masquerades as a legitimate claim interface, tricking users into authorizing malicious transactions that drain wallets without warning. Threat actors leverage social engineering tactics—urgent “connect your wallet to claim funds” messaging—to exploit haste and oversight, leading to irreversible asset loss once authorized. This domain was flagged via seed a44f31 and exhibits low detection rates across security engines, registering 1 out of 95 detections on VirusTotal at the time of discovery. It is registered through Cloudflare, Inc., resolving to IP 172.66.45.35, and leverages a Let’s Encrypt SSL certificate to appear trustworthy. The use of Pages.dev infrastructure allows rapid deployment and rotation, complicating takedown efforts and enabling sustained operation. If you visited claim-asteroid.pages.dev, immediately revoke any wallet connections authorized on this site using your wallet’s connection manager or browser extension. Disconnect associated dApps and clear browser cache and cookies to remove session tokens. Monitor wallet activity for unauthorized transactions and consider transferring remaining assets to a new, isolated wallet. Report the domain to your security team and block it at the network level to prevent further access.