claim[.]bravis[.]network

claim.bravis.network was registered on February 21 2026 through NiceNIC International Group Co., Limited and delegated to the Cloudflare nameservers nadia.ns.cloudflare.com and kyle.ns.cloudflare.com. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. TLS termination is provided by Google Trust Services under the WE1 certificate, indicating a valid public‑trusted certificate chain. HTTP requests return a 403 status code, and the site serves content over HTTP/3, confirming the use of modern Cloudflare edge infrastructure. The page title returned by the server is “Brevis Claim Portal,” matching the reported scam type of a crypto‑drainer operation.

Independent security feeds have flagged the domain. PhishDestroy and ScamSniffer list it as blocked, and it appears on two additional security blocklists. VirusTotal analysis shows that eight of ninety‑three scanners flagged the domain as malicious, reinforcing the suspicion of abusive activity. No further public intelligence, such as OTX or Safe Browsing entries, is currently available.

The combined evidence—recent registration, Cloudflare hosting, a legitimate‑looking TLS certificate, a 403 response, the “Brevis Claim Portal” title, and multiple blocklist entries—supports the conclusion that claim.bravis.network was employed as a crypto‑drainer front. The exact mechanisms of the drain (e.g., wallet address collection or transaction redirection) have not been observed, leaving the operational details uncertain. Defenders should continue to block the domain at network perimeter devices, update intrusion‑prevention signatures to include the associated IP and nameserver pair, and monitor for any resurgence of the domain or similar Cloudflare‑hosted assets that reference the same page title.