claimfun[.]live

The domain claimfun.live is a phishing site engaged in brand impersonation, specifically targeting Revolut users with a fraudulent airdrop scam. This site was designed to deceive visitors into believing they were interacting with a legitimate cryptocurrency airdrop, but it operated as a credential or wallet-harvesting scheme. No crypto drainer kit was identified in this campaign. As of the latest verification, claimfun.live has been taken offline.

Technical indicators confirm the malicious nature of claimfun.live. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and Seclookup, and appeared on 1 security blocklist (PhishDestroy). It was registered through Cloudflare, Inc. and resolved to the IP address 172.67.138.177, hosted on Cloudflare's network (AS13335) in the US. The site's nameservers were georgia.ns.cloudflare.com and oswald.ns.cloudflare.com, and no SSL certificate was present. The observed page title was 'PUMP FUN | AIRDROP', a common tactic to lure victims with false promises of rewards.

Individuals who interacted with claimfun.live should take immediate safety steps. If credentials or wallet details were entered, change passwords for all associated accounts and enable two-factor authentication (2FA) where possible. Monitor accounts for unauthorized transactions or signs of fraud. For cryptocurrency wallets, revoke any token approvals granted to unknown or suspicious contracts. Report the domain to relevant platforms, such as Google Safe Browsing, anti-phishing organizations, or the impersonated brand (Revolut), to aid in broader mitigation efforts.