grvt[.]claimboard[.]io

This domain, grvt.claimboard.io, is actively distributing a crypto drainer designed to siphon digital assets from victims under the guise of token reward distribution. The page title, 'Grvt Claimboard | Earn $Grvt Token Rewards,' mimics legitimate airdrop or reward platforms, luring users into connecting wallets to malicious smart contracts. Once connected, the drainer executes unauthorized transactions, transferring tokens or NFTs to attacker-controlled addresses without user consent. Analysis indicates this is a targeted attack against cryptocurrency holders seeking reward opportunities, with a focus on Ethereum and EVM-compatible chains. Infrastructure analysis reveals the domain was registered on June 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. VirusTotal detections stand at 2 out of 95 security vendors, a low but notable ratio that suggests emerging or evasive threat characteristics. No entries were found in major blocklists at the time of analysis, indicating the domain may still be in the early stages of deployment or evading broader detection. Users who visited grvt.claimboard.io or interacted with its content should immediately revoke any wallet connections made to the site. Audit all connected applications via wallet settings and remove any unknown or suspicious permissions. Review transaction histories for unauthorized transfers, particularly those involving token approvals or asset movements to unfamiliar addresses. If assets were lost, report the incident to relevant blockchain explorers and law enforcement with transaction hashes and timestamps. Monitor accounts for further suspicious activity and consider migrating assets to a new wallet if compromise is confirmed.