usa-julyclaim[.]com

This domain operates as a crypto asset drainer, specifically engineered to compromise digital wallets by executing unauthorized transactions. Analysis indicates the site employs obfuscated JavaScript to interact with blockchain networks, silently transferring cryptocurrency to attacker-controlled addresses without user consent. The threat primarily affects users who connect their wallets to the site under false pretenses, such as fake airdrops, token claims, or reward programs. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through Dynadot LLC on February 21, 2026, an unusual future date that may indicate registry manipulation or falsified records. It resolves to IP address 172.67.173.65, hosted on Cloudflare's network (AS13335), and is flagged by 10 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has classified it as phishing. The page title, Plesk Obsidian 18.0.70, suggests the use of a legitimate hosting control panel, which may be exploited to lend a false sense of legitimacy. Users who have visited usa-julyclaim.com or connected a wallet to the site should immediately revoke any active wallet permissions associated with the domain. It is recommended to transfer remaining assets to a new, secure wallet and monitor all connected accounts for unauthorized transactions. Browser-based wallet extensions should be reviewed for unexpected site authorizations, and any suspicious activity should be reported to relevant blockchain explorers or security teams. Given the high-risk nature of this threat, affected users are advised to assume their wallet credentials may be compromised and take proactive steps to secure their digital assets.