diff --git a/data/urls.yaml b/data/urls.yaml
index f04bf60..566df79 100644
--- a/data/urls.yaml
+++ b/data/urls.yaml
@@ -73195,3 +73195,9 @@
     Fake Ledger site phishing for secrets with POST
     /wp-includes/js/crop/ledger/com/support/reset/seed/send.php
   reporter: CryptoScamDB
+- name: claim.rewards-extended.exchange
+  url: 'https://claim.rewards-extended.exchange'
+  category: Phishing
+  subcategory: Extended
+  description: 'Wallet drainer impersonating Extended (extended.exchange); domain rewards-extended.exchange registered 2026-07-13 via WebNic, Cloudflare-fronted; loads obfuscated JS at /arxcdr.php soliciting malicious token approvals / gasless signatures to drain wallets.'
+  reporter: gaugau3000