claim-opengradient[.]xyz

This domain operates as a crypto_drainer, a specialized threat designed to intercept and divert cryptocurrency transactions to attacker-controlled wallets. When a user initiates a legitimate transaction, often through a compromised interface or deceptive link, the domain silently modifies the destination address to one operated by cybercriminals. Funds are then irrecoverably transferred to fraudulent accounts, resulting in financial loss with no possibility of reversal. The domain mimics legitimate services, exploiting user trust in familiar branding to facilitate unauthorized fund transfers. Analysis indicates this is not an attempted phishing lure but an active deployment targeting cryptocurrency users directly.

Analysis indicates this domain resolves to IP address 104.21.76.165 and is currently hosted on infrastructure associated with Cloudflare’s nameservers (adam.ns.cloudflare.com, danica.ns.cloudflare.com). The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 21, 2026, and remains active despite appearing on 2 security blocklists. Uniquely, as of seed a45b69, it shows 0 detections across 95 security engines on VirusTotal, indicating it has evaded immediate signature-based detection. The recent creation date and clean detection profile suggest a high likelihood of being a newly deployed or rotating infrastructure component in an ongoing campaign.

If you visited this domain, immediately check all cryptocurrency wallet transactions for any unauthorized transfers. Disconnect any connected hardware wallets and revoke any recently approved smart contract permissions. Do not approve new transaction requests without verifying the recipient address offline. If funds were stolen, report the incident to local law enforcement and blockchain analytics firms with the transaction hash. Avoid reusing browser sessions or wallets that may have been exposed during this visit. Consider resetting browser profiles and clearing cached data to prevent persistent tracking. Monitor blockchain explorers for any new transactions linked to this domain or its associated addresses. Stay vigilant for follow-up phishing attempts exploiting this exposure.