rizzmas-claim[.]live

This domain, rizzmas-claim.live, functions as a crypto drainer phishing site designed to deceive users into connecting their digital wallets under the guise of a promotional token event. Once a user interacts with the site, malicious scripts automatically siphon cryptocurrency assets without consent, often resulting in irreversible financial loss. The site mimics legitimate token campaigns by using festive branding, such as the page title '$RIZZMAS - The Most Festive Token in Crypto,' to exploit seasonal trends and user curiosity. Analysis indicates the domain was registered on June 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.6.195 and is flagged by 9 out of 95 security vendors on VirusTotal, including detection by MetaMask, PhishDestroy, SEAL, and ScamSniffer. The domain appears on four security blocklists and has been documented in two AlienVault OTX threat intelligence pulses, reinforcing its malicious classification. Technologies detected on the site include Cloudflare, HSTS, and HTTP/3, which are often leveraged to obfuscate malicious activity and enhance phishing infrastructure resilience. If you visited rizzmas-claim.live or interacted with its content, immediately disconnect any connected wallets from the site and revoke all associated permissions using your wallet’s settings. Scan your device for malware using updated security tools to ensure no persistent threats remain. Report the incident to relevant blockchain security platforms to assist in tracking and mitigating further abuse. Avoid re-engaging with any domains tied to the same registrar or IP range, as they may pose similar risks. Monitor wallet activity closely for unauthorized transactions and consider transferring assets to a new wallet if compromise is suspected.