claims-falcon[.]finance

This domain is flagged as a high-risk crypto drainer, designed to siphon cryptocurrency assets from victims by impersonating legitimate financial platforms. Analysis indicates the site targets users through deceptive claims pages, tricking them into connecting wallets to malicious smart contracts that execute unauthorized transactions. The threat is classified as a crypto drainer due to its direct financial theft mechanism, which bypasses traditional credential harvesting. Infrastructure analysis reveals the domain resolves to IP 104.21.49.153 and was registered through Cloudflare, Inc. Security vendors on VirusTotal flagged the domain at a rate of 11/95, while independent trust scoring systems assigned it a 0/100 trust rating. The domain appears on four security blocklists and is actively blocked by multiple browser extensions and security tools, including Polkadot, Codeesura, PhishDestroy, and Enkrypt. The page title, 'Claims | Falcon Finance,' suggests an attempt to mimic legitimate airdrop or claim portals associated with the Falcon Finance brand. Mitigation requires immediate action from both users and network defenders. Users who interacted with the domain should revoke all connected wallet permissions via blockchain explorers and transfer remaining assets to new, secure wallets. Network-level protections should include DNS sinkholing for the domain and IP, as well as blocking outbound connections to the resolved IP address. Organizations should monitor for wallet addresses or smart contract interactions tied to this campaign, as crypto drainers often reuse infrastructure across multiple domains. Due to the offline status, further forensic analysis of cached or archived pages may be necessary to extract additional indicators of compromise.