claim[.]iryys[.]icu

Analysis of claim.iryys.icu shows a newly registered domain created on February 21, 2026 and managed through NameSilo, LLC. The site is protected by a Google Trust Services / WE1 SSL certificate and returns an HTTP 403 status with the page title "Just a moment...". Cloudflare provides DNS resolution via hank.ns.cloudflare.com and virginia.ns.cloudflare.com, and the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The presence of HTTP/3 indicates modern protocol support.

VirusTotal scans have recorded three detections out of ninety‑five security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, suggesting a lack of confidence in the site's legitimacy. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. These indicators collectively place the site in the high‑risk category for crypto‑drainer activity.

The observed infrastructure points to a typical abuse pattern where legitimate cloud services are leveraged to mask malicious intent. While the site currently returns a 403 response, the underlying intent is identified as a cryptocurrency scam, consistent with the "crypto_drainer" classification. The exact payload or wallet addresses targeted by the campaign remain undisclosed, and the operator’s identity cannot be derived from the available data, representing a gap in attribution.

Defenders should prioritize blocking DNS resolution for claim.iryys.icu and monitoring outbound connections to the associated IP address 188.114.97.3. Network sensors should flag any HTTP/3 traffic to Cloudflare edge nodes that resolve to this domain. Incident response teams should also update endpoint detection rules to incorporate the observed SSL certificate fingerprint and the specific page title pattern. Continuous re‑evaluation is advised, as threat actors may repurpose the same infrastructure for additional campaigns.