dripclaim[.]xyz

PhishDestroy identified dripclaim.xyz as a brand impersonation threat targeting the Across brand. The domain was found to be hosting a fraudulent version of the Drip Ethereum Gas Tracker & DeFi Tools interface. This site is designed to trick users into connecting their wallets, potentially leading to the theft of cryptocurrency and sensitive credentials. The domain is currently offline but poses a significant risk to anyone who may have interacted with it while active.

The technical indicators for dripclaim.xyz are alarming. VirusTotal reports that 5 out of 95 security vendors flag this domain as malicious. It was registered through NameSilo, LLC on August 16, 2025, and resolves to IP address 102.212.246.67. The site had an SSL certificate (R10) and appeared on 4 security blocklists. Google Safe Browsing likely flagged it, contributing to its takedown. These details confirm that the domain was deliberately set up for malicious purposes shortly before being shut down.

As of the latest check, dripclaim.xyz is offline, indicating that security teams or hosting providers have taken action. However, the domain could reappear under a different name or IP. Users should remain cautious of any unsolicited links claiming to offer Ethereum gas tracking or DeFi tools, especially those mimicking legitimate brands like Across. PhishDestroy advises users to verify URLs independently, never connect wallets to untrusted sites, and report any suspicious domains to relevant authorities. The combination of brand impersonation and recent creation makes this a high-risk threat for the crypto community.