claim-dot-hyperlock[.]pages[.]dev

This domain, claim-dot-hyperlock.pages.dev, is flagged as a crypto drainer site impersonating Hyperlock Finance. Analysis indicates the threat actor deployed a wallet-draining script designed to siphon cryptocurrency assets from victims interacting with the site. The page title explicitly mimics Hyperlock Finance, a legitimate decentralized finance platform, suggesting an intent to deceive users into connecting wallets under false pretenses. No specific drainer kit has been attributed yet, but the domain exhibits characteristics consistent with known crypto-draining infrastructure, including the use of Cloudflare hosting to obscure origin servers. Technical indicators reveal the domain was registered on October 09, 2024, through Cloudflare, Inc., and resolves to IP address 172.66.47.88, part of AS13335. VirusTotal currently reports 0 detections out of 95 engines, indicating low initial detection rates despite its malicious intent. The domain appears on one security blocklist, though Google Safe Browsing has not yet flagged it. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy, a common tactic in phishing and drainer operations. The domain remains active as of the latest verification, with no takedown or sinkholing observed. Response actions should include immediate blacklisting in enterprise security tools, DNS filtering at the resolver level, and endpoint protection rules to block user access. Given the 0/95 VirusTotal detection rate, organizations should prioritize manual threat hunting for related indicators, including the IP address and SSL certificate thumbprint. Users are advised to revoke any wallet permissions granted to this domain and monitor connected accounts for unauthorized transactions. The risk of asset loss persists until the domain is fully neutralized.