claim-cherry[.]info

This domain is flagged as a high‑risk crypto drainer. The site presents the page title “Cherry.fun | Wallet Messaging”, indicating a wallet‑messaging interface likely used to solicit cryptocurrency transfers. The domain resolves to 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and the TLS certificate is issued by Let’s Encrypt (E7). Registration occurred on 12 Mar 2026 through NiceNIC International Group Co., Limited, with authoritative nameservers jade.ns.cloudflare.com and eoin.ns.cloudflare.com. VirusTotal records show 13 of 94 security vendors flag the host, and AlienVault OTX references the domain in 24 separate threat pulses. The IP address appears on four security blocklists, and the domain is listed by multiple anti‑phishing feeds. Technical fingerprinting reveals HSTS, Cloudflare Browser Insights, and HTTP/3 support, and the HTTP response code is 200. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious classification. While the exact phishing page content has not been publicly released, the combination of a wallet‑related title, crypto‑drainer classification, and extensive vendor detections suggests an active campaign to trick users into sending cryptocurrency. Defenders should block the domain at network perimeter, add the IP address 188.114.96.3 to deny‑list rules, and monitor for any outbound connections to the associated wallet address if known. Continuous threat‑intel feeds should be consulted for updates, and any internal alerts referencing “Cherry.fun” or similar wallet‑messaging terminology should be investigated as potential compromise attempts.