claim[.]wikicat[.]cyou

On 24 July 2026, analysis of the domain claim.wikicat.cyou confirms that it was used as a crypto‑drainer infrastructure. The domain was registered on 15 August 2025 through Dynadot LLC and is delegated to the authoritative name servers ns1.dyna‑ns.net and ns2.dyna‑ns.net. DNS resolution points to the address 199.59.243.228, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. An HTTP request to the host returns a 200 OK response, but the site does not present an SSL/TLS certificate, indicating that communications are unencrypted.

The page title returned by the server is “wikicat.cyou”, matching the observed title in the intelligence feed. Malware scanning on VirusTotal recorded a single positive detection out of 95 security vendors, and the domain is listed on one public blocklist, specifically PhishDestroy, which has flagged it as malicious. The observed payload corresponds to an “Airdrop Scam” kit, a known pattern used to lure cryptocurrency holders into submitting private keys or signing malicious transactions. The current operational status is marked as offline, suggesting that the hosting or the malicious content has been removed or taken down, but the historical evidence indicates that the infrastructure was active at least until the time of the last scan.

Uncertainties remain regarding the exact content served at the URL, the extent of victim exposure, and whether additional sub‑domains or related IP addresses were part of the campaign. Defenders should block DNS resolution for claim.wikicat.cyou and its associated IP address, enforce TLS inspection to detect any future unencrypted traffic, add the domain to internal blocklists, and monitor for similar Airdrop‑kit signatures in network traffic. Continuous re‑query of threat intelligence feeds for updates on the IP 199.59.243.228 and any new listings on blocklists is recommended to capture potential re‑use of the infrastructure.