claim[.]ilit[.]lat

The domain claim.ilit.lat was registered on May 12, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and has been observed in active malicious campaigns. Intelligence sources classify it as a crypto‑drainer, a variant of malware that seeks to exfiltrate cryptocurrency wallets or redirect mining traffic to attacker‑controlled pools. The domain appears on a single security blocklist and is currently listed as active. Infrastructure analysis shows the domain resolves to IP address 104.21.85.26, which belongs to Cloudflare, Inc. and is geolocated to Canada. The site is protected by a Let’s Encrypt certificate (issuer E8) and uses Cloudflare’s default nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com. An HTTP request returns a 403 status code, indicating that direct content inspection is blocked. The domain’s trust score from Gridinsoft is 0 out of 100, and VirusTotal flags it by 2 of 95 scanned security vendors. PhishDestroy has also added the domain to its blocklist. The low trust rating, limited vendor detections, and blocked HTTP response suggest a deliberately concealed payload. While the exact crypto‑drainer mechanism cannot be confirmed without content analysis, the combination of recent registration, Cloudflare fronting, and minimal detection aligns with typical fast‑flux or abuse‑of‑legitimate hosting patterns used to hide malicious scripts. The high risk rating reflects the potential financial impact if the domain is used to lure victims into installing wallet‑stealing tools or redirecting mining hash power. Defenders should immediately block claim.ilit.lat at the DNS and proxy layers, enforce TLS inspection where possible, and monitor outbound connections to the associated IP address for anomalous cryptocurrency‑related traffic. Continued scanning of the domain for changes in response codes or additional vendor detections is recommended, and any observed exploitation attempts should be reported to relevant incident‑response teams.