soilclaim[.]app

PhishDestroy identifies soilclaim.app as an active crypto drainer domain impersonating soil claim services to harvest cryptocurrency wallets. This domain deploys a high-risk drainer kit designed to siphon funds from unsuspecting victims under the guise of legitimate soil compensation claims. The infrastructure is purpose-built for crypto theft, leveraging deceptive domains and social engineering tactics to trick users into connecting their wallets for fraudulent transactions.

This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating elevated malicious activity. It resolves to IP 188.114.96.3, was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 10, 2026, and holds a Let's Encrypt SSL certificate. The domain has not been classified by Google Safe Browsing and remains unblocked by most threat intelligence platforms, increasing exposure risk to potential victims. The combination of a newly created domain, low detection rate, and crypto-focused malicious intent suggests a rapidly evolving threat with high attack potential.

As of the latest assessment, soilclaim.app remains active and poses an elevated risk to cryptocurrency users. PhishDestroy recommends immediate network and endpoint blocking of the domain and associated IP. Users interacting with soil claim services should verify official channels and avoid clicking unsolicited links. While the current detection gap persists, proactive monitoring and blocking can significantly mitigate exposure. Remaining risk is assessed as high due to active campaigning and low vendor detection.