claim[.]succinict[.]network

claim.succinict.network is currently active and classified as a crypto‑drainer campaign. The domain resolves to 104.21.80.1, an address owned by AS13335, a large CDN provider located in the United States. Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are earl.ns.cloudflare.com and melody.ns.cloudflare.com, indicating use of the provider’s DNS service. TLS is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain, and the site returns HTTP 403 for the initial request. The only visible page title is “Nur einen Moment…”, which does not disclose any additional context. Automated analysis identified the presence of the provider’s browser‑insights script and HTTP/3 support. The domain has been added to one security blocklist and is blocked by the PhishDestroy feed. VirusTotal records show two of ninety‑five scanners flagging the domain as malicious, confirming a low but non‑zero detection rate. No further payload or landing‑page details have been disclosed. Defenders should continue to monitor DNS and IP activity associated with 104.21.80.1, enforce blocklisting of the domain and its resolving address, and consider extending protective rules to the hosting provider’s IP space. Given the active status and the crypto‑drainer classification, organizations handling cryptocurrency transactions should treat any traffic to this domain as high‑risk.