claim[.]etherieum[.]com

This domain, claim.etherieum.com, is identified as a crypto_drainer infrastructure component. Analysis indicates it impersonates a legitimate cryptocurrency claim portal, likely targeting users with fraudulent token airdrop or reward schemes. The domain leverages a typosquatting variant of the Ethereum brand, redirecting victims to a wallet-draining script designed to siphon digital assets upon interaction. No specific drainer kit variant has been attributed to this instance, though behavioral patterns align with known crypto_drainer frameworks observed in prior campaigns. Infrastructure analysis reveals the domain was registered through a privacy-protected registrar on November 24, 2025, and resolves to the IP address 188.114.97.3. Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist, and its Gridinsoft trust score is 0/100, indicating high-risk classification. No entries were found in Google Safe Browsing at the time of assessment. The registrar, Spaceship, Inc., is frequently associated with domains exhibiting malicious or deceptive behavior, though no direct attribution to this entity is confirmed. As of the latest assessment, claim.etherieum.com has been taken offline, reducing immediate exposure. However, residual risk persists due to the potential for infrastructure reuse or re-registration under alternate TLDs or subdomains. Network defenders are advised to monitor for related indicators, including the IP address 188.114.97.3 and the unique seed ffc831, which may correlate with additional malicious domains. Organizations should block the domain at perimeter security controls and update endpoint detection rules to prevent interaction with any residual or resurfaced instances of this threat.