registrations-rayls[.]live

registrations-rayls.live was registered on 21 November 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers ns13.v-sys.org and ns14.v-sys.org resolve the domain to the IPv4 address 95.214.235.117, which is assigned to AS30860 Virtual Systems LLC and geolocated to Ukraine. No TLS certificate is presented; HTTP connections are served without encryption. The site’s only observed page title is “Rayls Airdrop,” and the underlying malicious kit has been identified as an “Airdrop Scam” targeting cryptocurrency users.

VirusTotal analysis recorded ten positive detections out of ninety‑five scanners, indicating a moderate level of malicious confidence among security vendors. The domain has been listed on two public blocklists and is actively blocked by the PhishDestroy and ScamSniffer filtering services. As of the report date, the site is offline, and no live HTTP response could be captured.

Evidence gaps include the lack of a current page snapshot, absence of SSL/TLS, and no publicly disclosed Safe Browsing or OTX entries. Defenders should continue to block the IP 95.214.235.117 and the domain name at DNS and proxy layers, monitor for any re‑hosting on alternative infrastructure, and consider adding the indicator set to internal threat‑intel feeds. Ongoing observation of the registrar NiceNIC for future registrations and of the v‑sys nameserver range is recommended to detect potential reuse of the same hosting assets.