postoffice[.]claimhere[.]co[.]uk

The domain postoffice.claimhere.co.uk poses a serious crypto drainer threat, designed to trick users into connecting their cryptocurrency wallets under the guise of a legitimate Post Office travel claims service. Once connected, the site deploys malicious scripts that drain funds from the victim's wallet, leading to irreversible financial loss. This type of threat targets individuals expecting compensation or refunds, exploiting trust in a well-known brand like the Post Office. The site is now offline, but the risk remains for anyone who may have visited it earlier.

PhishDestroy identified this domain through multiple intelligence sources. VirusTotal flagged it with 3 out of 95 security vendors marking it as malicious, a clear indicator of its dangerous nature. The domain was created on March 29, 2026, a very recent registration that aligns with typical scam timelines. It was registered through Safenames Ltd and uses an SSL certificate from Let's Encrypt (E7), which unfortunately gives it a false sense of security. The domain resolves to IP address 172.66.0.145 and currently appears on two security blocklists. These concrete data points confirm the site's intent and the high likelihood of harm.

If you or someone you know visited this domain, act immediately. Do not enter any personal information or connect a cryptocurrency wallet. If a wallet was connected, revoke all permissions for the site and transfer remaining funds to a new, secure wallet. Run a full antivirus scan on any device used to access the site. Monitor accounts for suspicious activity and consider enabling two-factor authentication. PhishDestroy recommends staying vigilant and always verifying the legitimacy of any claims-related website before engaging, especially those involving cryptocurrency transactions.