claim-openeden[.]live

The domain claim-openeden.live is currently active and classified as a high-risk crypto drainer. It resolves to the IP address 172.67.166.70 and employs technologies including Cloudflare Browser Insights and HTTP/3, indicating an attempt to shield its true purpose behind a reputable CDN. The SSL certificate is issued by Google Trust Services, which is a common practice among malicious domains to instill a false sense of security.

Security analysis reveals that this domain has been flagged by 13 out of 95 security vendors on VirusTotal, suggesting widespread recognition of its malicious nature. It is also listed on two security blocklists and has been included in 24 threat intelligence pulses from AlienVault OTX. The domain was registered through Web Commerce Communications Limited on March 11, 2026, and has a Gridinsoft trust score of 0 out of 100, confirming its high-risk designation.

Defenders should be particularly cautious given that the domain is actively being blocked by known security solutions such as PhishDestroy and BLP-Malware. The title of the page, "Just a moment...", is often associated with phishing attempts that attempt to delay users while malicious scripts are executed in the background. The indicators suggest that the domain is part of a larger operation aimed at draining cryptocurrencies from unsuspecting users.

Due to the active nature and high-risk assessment of claim-openeden.live, immediate action is recommended. Organizations should update their security protocols to block this domain and monitor for any associated activity. Continuous threat intelligence gathering is essential to understand the evolving tactics employed by such malicious actors.