claim-imfebu[.]app

The domain www.claim-imfebu.app is currently active and has been identified as a crypto‑drainer threat. Infrastructure analysis shows the domain resolves to the IP address 196.251.107.102, indicating a single‑host deployment. The domain’s nameserver configuration is missing, reported as NS_NOT_FOUND, which hampers typical DNS‑based verification but does not prevent resolution to the host. VirusTotal has recorded detections from five of ninety‑five scanning engines, confirming that a subset of security tools recognize malicious behavior associated with the domain.

Independent blocklist services have added the domain to four separate security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, reflecting consensus among anti‑phishing and cryptocurrency‑wallet protection platforms. No additional intelligence such as SSL certificate details, HTTP response codes, or page titles is available at this time. The lack of further public metadata leaves the exact delivery mechanism and victim interaction flow uncertain, but the presence on multiple reputable blocklists and detection by several vendors strongly suggests active exploitation aimed at draining cryptocurrency assets.

Defenders should continue to block the domain at network perimeters, enforce DNS filtering, and monitor outbound connections to the associated IP. Users of cryptocurrency wallets should be advised to avoid any unsolicited requests that reference this domain and to keep wallet software updated to leverage built‑in blocklist protections. Ongoing threat‑intel collection is recommended to capture any future changes in hosting, infrastructure, or observed payloads.