claim-zora[.]com

The domain claim-zora.com is a phishing site engaged in brand impersonation targeting the Zora cryptocurrency platform. It was designed to deceive users into believing they were interacting with an official Zora service, likely to steal credentials or sensitive information related to cryptocurrency transactions. No drainer kit was identified in this campaign. The site is currently taken offline, but its prior activity poses an elevated risk to users who may have visited it before its removal.

Technical indicators confirm the malicious nature of claim-zora.com. The domain was flagged by 1 of 95 security vendors on VirusTotal, including Gridinsoft, which assigned it a trust score of 0/100. It appears on 2 security blocklists, specifically PhishDestroy and ScamSniffer, though Google Safe Browsing did not flag it. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on August 17, 2025, the domain resolved to the IP address 104.21.80.1, hosted by Cloudflare, Inc. in the US. The SSL certificate was issued by Cloudflare TLS Issuing ECC CA 1, and the observed page title was 'Just a moment...'.

Users who interacted with claim-zora.com should take immediate safety steps. If cryptocurrency-related credentials or wallet access were provided, revoke any token approvals and transfer funds to a new, secure wallet. Enable two-factor authentication (2FA) on all accounts and monitor for unauthorized transactions or login attempts. Change passwords for any accounts accessed while visiting the site. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to help prevent further victimization.