claimallocation[.]live

This domain, claimallocation.live, operates as a crypto drainer phishing site designed to deplete cryptocurrency wallets by tricking users into authorizing malicious transactions. The page impersonates Ethena, a legitimate cryptocurrency platform, to exploit trust and prompt victims into connecting their wallets. Once connected, the site executes unauthorized transfers, draining funds without further user interaction. The threat is classified as elevated due to its active exploitation of wallet integration protocols and the irreversible nature of cryptocurrency transactions. Analysis indicates the domain was registered on May 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.58.152 and is flagged by 9 out of 95 security vendors on VirusTotal, including multiple wallet security providers. The domain appears on three distinct security blocklists, and its infrastructure leverages Cloudflare services, including HSTS and HTTP/3, to evade detection and enhance perceived legitimacy. The SSL certificate is issued by Let’s Encrypt, a common tactic to mimic secure connections while masking malicious intent. A Gridinsoft trust score of 0/100 further corroborates its classification as a malicious entity. Users who have interacted with claimallocation.live should immediately revoke any wallet authorizations granted to the domain via their wallet’s connected sites or dApp permissions. It is critical to transfer remaining funds to a new, secure wallet address and monitor transaction histories for unauthorized activity. If credentials or private keys were entered, the compromised wallet should be considered fully exposed, and all associated assets should be migrated to a fresh wallet. Enabling multi-factor authentication on all cryptocurrency-related accounts and scrutinizing future connection requests from unknown domains are strongly recommended to mitigate further risk.