eth-claims[.]live

Analysis of eth-claims.live, observed on July 24 2026, identifies the site as an active crypto‑drainer infrastructure. The domain was registered on 21 February 2026 through Web Commerce Communications Limited and resolves to the Cloudflare‑managed address 104.21.15.149, belonging to AS13335 in the United States. DNS resolution uses the Cloudflare authoritative nameservers will.ns.cloudflare.com and raphaela.ns.cloudflare.com, confirming the reliance on Cloudflare’s edge network and the presence of HTTP/3 support. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain but offering no assurance of legitimacy.

The HTTP response is a permanent redirect (301) to a page whose title reads “MegaETH | Public Sale”, a phrasing commonly associated with token offerings. The site is currently flagged by three independent blocklists and has been intercepted by PhishDestroy, MetaMask, and SEAL, all of which classify it as a crypto‑drainer. VirusTotal analysis shows eleven of ninety‑three security engines label the domain as malicious, reinforcing the suspicion. No additional intelligence such as sandboxed page content or malware payloads is available, leaving the exact phishing flow and victim interaction unverified.

Defenders should prioritize blocking the domain at network perimeter and endpoint layers, enforce DNS sink‑hole or filtering policies that include the identified blocklists, and monitor for outbound connections to the Cloudflare IP range used by the domain. Because the TLS certificate is valid, reliance on certificate trust alone is insufficient; correlation with the observed page title, redirect behavior, and the specific threat signatures reported by PhishDestroy, MetaMask, and SEAL provides a robust detection basis. Continuous re‑scanning with multi‑engine services is advised to capture any evolution in the payload or hosting configuration.