hayleys[.]digital

Analysis of the domain hayleys.digital shows an active infrastructure that matches a high‑risk crypto‑drainer campaign. The domain was registered on April 17 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, resolving to IP 188.114.97.3, which is geolocated in Canada and associated with Cloudflare, Inc. The name servers elliott.ns.cloudflare.com and audrey.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. The site presents an HTTP 403 response, employs HSTS, and serves a Let’s Encrypt/Y‑E1 certificate, indicating encrypted traffic. Detected web technologies include Prismic, Google Cloud, OneTrust, Google Tag Manager, Google Cloud Trace, Facebook Pixel, and Akamai, suggesting a layered stack that may be used to host malicious content or track victims. The page title reported is "www.insidelvmh.com," but no further content analysis is available. Security telemetry shows the domain is blocked by PhishDestroy, appears on one security blocklist, and received a Gridinsoft trust score of 0 / 100. VirusTotal flagged the domain with three detections out of 94 scanners, reinforcing the malicious assessment. While the exact payload or phishing page has not been captured, the convergence of a recent registration, low trust score, multiple detections, and the classification as a crypto drainer indicates a high likelihood of fraudulent activity aimed at extracting cryptocurrency. Defenders should block the domain at perimeter firewalls and DNS filtering, monitor for any outbound connections to the associated IP, and advise users to avoid any unsolicited requests for crypto transfers originating from this URL.