claims-kangamoon[.]web[.]app

This domain, claims-kangamoon.web.app, operates as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency from victims' wallets. Crypto drainers typically exploit social engineering tactics, such as fake token airdrops or wallet connection prompts, to trick users into authorizing transactions that transfer funds to attacker-controlled addresses. Once permissions are granted, the drainer silently executes unauthorized transactions, often emptying wallets within seconds. The threat is particularly insidious because it relies on user interaction rather than exploiting software vulnerabilities, making traditional security measures like firewalls or antivirus less effective against it. Analysis indicates that claims-kangamoon.web.app is flagged by 1 out of 95 security vendors on VirusTotal, a notably low detection rate that suggests either evasion techniques or recent deployment. The domain is registered through Google LLC, leveraging Google's Firebase hosting platform, which resolves to the IPv6 address 2620:0:890::100 under AS54113 (Fastly, Inc.). The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while obscuring the malicious intent. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed, yet it remains operational, indicating ongoing abuse. The page title, claims-kangamoon, aligns with common airdrop scam patterns, where attackers impersonate legitimate projects to lure victims. If you have visited claims-kangamoon.web.app or interacted with its content, immediate action is required to mitigate potential losses. First, revoke any wallet permissions granted to the domain using a blockchain explorer or wallet interface, as these permissions may persist even after leaving the site. Next, transfer remaining funds to a new, secure wallet address that has never been exposed to the malicious domain. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain security platforms or community forums to warn others. Avoid reusing passwords or wallet seeds associated with the compromised interaction, as attackers may attempt credential reuse across other platforms. Finally, consider reporting the domain to the hosting provider (Google LLC) and relevant abuse channels to aid in takedown efforts.