claimyourevrrewardsntrk[.]icu

On 25 July 2026 the domain claimyourevrrewardsntrk.icu was observed to be taken offline after being flagged as a crypto‑drainer scam. The domain was registered through NiceNIC International Group Co., Limited on 21 November 2025 and is hosted behind Cloudflare’s network (ASN 13335) with the IP address 172.67.156.68 located in the United States. No TLS certificate is presented, indicating the site served only HTTP or an invalid HTTPS configuration. DNS resolution points to two Cloudflare name servers, dean.ns.cloudflare.com and meera.ns.cloudflare.com, which is typical for domains that rely on Cloudflare’s edge services for rapid deployment and obscuration. The page title returned by the web server is the generic string “Just a moment…”, providing no insight into the intended victim interaction.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis shows that 7 of 95 scanning engines classify the domain as malicious, reinforcing the suspicion of malicious activity. The domain appears on a single known security blocklist and has been explicitly blocked by the PhishDestroy service. The lack of additional blocklist references suggests limited propagation at the time of observation, but the existing detections indicate a high likelihood of credential‑stealing or crypto‑wallet draining behavior as implied by the “Crypto Scam” label. Uncertainty remains regarding the specific payload or phishing kit employed, as no sample URLs, malware hashes, or victim reports have been disclosed.

Likewise, the exact mechanism of the crypto drain—whether through malicious smart‑contract interaction, phishing for private keys, or deployment of browser‑based miners—has not been confirmed. Defenders should therefore treat any traffic to or from claimyourevrrewardsntrk.icu as hostile.