claimhaul[.]com

This domain, claimhaul.com, is identified as a crypto drainer phishing site designed to deceive users into engaging with fraudulent offers. The page title, "Shein $750 Voucher - Ready to Buy Your Dream Haul?", suggests an attempt to impersonate the Shein brand, luring victims with the promise of monetary incentives. Crypto drainers are malicious scripts that automatically siphon cryptocurrency from connected wallets, often resulting in irreversible financial losses for victims. No specific drainer kit has been conclusively linked to this domain, but the infrastructure and tactics align with known crypto-focused phishing campaigns targeting retail and e-commerce brands. Analysis indicates that claimhaul.com exhibits multiple technical indicators of compromise. The domain was registered on September 03, 2025, through Name.com, Inc., and resolves to the IP address 98.84.224.111. It is flagged by 2 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100. The domain appears on one security blocklist and is hosted on infrastructure utilizing Netlify, with HSTS enabled. The SSL certificate is issued by DigiCert Inc, which, while legitimate, is commonly exploited by threat actors to lend credibility to malicious sites. No detections were reported by Google Safe Browsing at the time of analysis, but the domain was proactively blocked by PhishDestroy. As of the latest assessment, claimhaul.com has been taken offline, reducing immediate exposure to potential victims. However, the elevated risk level persists due to the domain's recent creation and the use of crypto drainer tactics. Organizations and individuals are advised to monitor for residual DNS caching or attempts to re-register the domain under alternative TLDs. Users who interacted with the site should immediately disconnect any connected wallets, revoke permissions for suspicious smart contracts, and audit transaction histories for unauthorized activity. Network defenders should update blocklists to include the domain and associated IP address, while security teams should investigate potential lateral movement or secondary infections stemming from this campaign.