From cd13af587595e5cbfa4c3bcc1a75e378b28e77e0 Mon Sep 17 00:00:00 2001
From: gaugau3000 <g.pialat@gmail.com>
Date: Tue, 14 Jul 2026 06:25:24 +0200
Subject: [PATCH] Add claim.rewards-extended.exchange (Extended wallet-drainer
 phishing)

Wallet drainer impersonating Extended (extended.exchange); domain registered
2026-07-13, loads obfuscated drainer JS at /arxcdr.php.
---
 data/urls.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/data/urls.yaml b/data/urls.yaml
index f04bf60..566df79 100644
--- a/data/urls.yaml
+++ b/data/urls.yaml
@@ -73195,3 +73195,9 @@
     Fake Ledger site phishing for secrets with POST
     /wp-includes/js/crop/ledger/com/support/reset/seed/send.php
   reporter: CryptoScamDB
+- name: claim.rewards-extended.exchange
+  url: 'https://claim.rewards-extended.exchange'
+  category: Phishing
+  subcategory: Extended
+  description: 'Wallet drainer impersonating Extended (extended.exchange); domain rewards-extended.exchange registered 2026-07-13 via WebNic, Cloudflare-fronted; loads obfuscated JS at /arxcdr.php soliciting malicious token approvals / gasless signatures to drain wallets.'
+  reporter: gaugau3000