briewis.network

The domain briewis.network was registered on February 21 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 188.114.97.3, an address owned by Cloudflare (AS13335) located in the United States. The domain is served behind Cloudflare's network, using the nameservers nadia.ns.cloudflare.com and kyle.ns.cloudflare.com, and supports HTTP/3. TLS negotiation presents a certificate issued by Google Trust Services under the WE1 root, indicating a valid SSL chain but not necessarily trustworthiness of the hosted content. An HTTP request to the root URL returns a 400 Bad Request response, while the page title returned is "Success!".

The site is associated with the Angel Drainer crypto‑drainer kit, a known malicious payload that attempts to steal cryptocurrency wallets. The infrastructure has been reported offline, and the host is currently listed on three public security blocklists. VirusTotal scans show that four of ninety‑three security vendors flagged the domain, and it is also blocked by the PhishDestroy, MetaMask, and SEAL blocklists, reinforcing the malicious classification. Evidence from these sources confirms the domain’s involvement in crypto‑drainer activity, but the limited public visibility of the payload’s delivery page prevents a full assessment of the exact phishing flow.

Defenders should block any outbound connections to 188.114.97.3, add the domain to URL filtering policies, and monitor for any attempts to resolve or contact the domain. Because the domain is hosted on a shared Cloudflare IP, any false‑positive mitigation should be evaluated against broader traffic patterns to avoid collateral impact. Continuous re‑checking of blocklist status and VirusTotal updates is recommended, as the offline status may change if the operators reactivate the infrastructure.