hl-eco[.]claims

The domain hl-eco.claims has been identified as a high‑risk crypto‑drainer operating since its registration on 26 May 2026. Threat intelligence classifies it as an active crypto‑drainer, indicating that the site is likely used to illicitly redirect cryptocurrency transactions or harvest wallet credentials. Its short age and immediate appearance on blocklists suggest a purpose‑built infrastructure rather than an opportunistic compromise. Infrastructure analysis shows the domain resolves to IP 188.114.97.3, which belongs to a Cloudflare network located in Canada. The site presents a valid Let’s Encrypt certificate (version E7) and returns HTTP 403 responses for most requests, a behavior consistent with attempts to hide malicious content behind access controls. Registration information lists PDR Ltd operating under PublicDomainRegistry.com, and the domain received a Gridinsoft trust score of 0 out of 100. Reputation signals reinforce the malicious assessment. The domain appears on three security blocklists and is flagged by two of ninety‑five VirusTotal scanners, a modest but notable detection rate for a newly created site. Additional security tooling has already blocked the domain, confirming that multiple detection engines recognize it as a threat. For defenders, immediate containment is recommended. The domain should be added to deny‑list rules on DNS resolvers and web proxy filters. Network traffic to the associated IP address must be blocked, and any endpoint that has communicated with the domain should be inspected for signs of unauthorized cryptocurrency operations or credential theft. Continuous monitoring of the IP range and certificate changes is advised, as threat actors may pivot to related infrastructure.