perle-claim[.]xyz

PhishDestroy identifies active crypto-draining infrastructure hosted at perle-claim.xyz, a recently registered domain engineered to siphon cryptocurrency from unsuspecting users. This site poses as a legitimate claim interface while covertly executing a drainer script designed to empty wallets in seconds. Current evidence does not show a direct brand impersonation, suggesting a generic but highly targeted lure aimed at luring crypto holders under the guise of an unclaimed-perks portal.

Technical indicators are sparse but telling. The domain was created on March 25, 2026, and resolves to IP address 104.21.23.67. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and secured with a Let’s Encrypt SSL certificate. VirusTotal currently shows 2 out of 95 scanners detecting the domain, and it remains absent from Google Safe Browsing and most public blocklists. This low detection profile indicates the threat is still under the radar and actively serving malicious content.

As of the latest analysis, perle-claim.xyz remains active and under investigation, with a status flagged as 'active' and a unique seed hash f7deda recorded by PhishDestroy’s crawlers. No takedown action has been observed, and the risk level is currently classified as 'under_investigation.' Users are strongly advised to avoid clicking any links or entering credentials on this domain. To stay protected, verify URLs using PhishDestroy’s real-time scanner before interacting with any crypto-related claim pages.