claim-fraud-portal-legacy[.]dashlyhr[.]com

This domain, claim-fraud-portal-legacy.dashlyhr.com, was set up to trick people into thinking it was a legitimate HR claim portal, but in reality it was a crypto drainer—a type of site designed to steal cryptocurrency by tricking visitors into connecting their wallets or entering sensitive information. The goal was to drain funds from unsuspecting users who believed they were accessing a genuine service.

The evidence is clear: the domain was created on March 06, 2023, and registered through Squarespace Domains II LLC. It was flagged by just 1 out of 95 security vendors on VirusTotal and appears on one security blocklist. The site featured an SSL certificate from Amazon (Amazon RSA 2048 M01) and resolved to IP 18.164.124.28. Fortunately, the site is now offline, meaning the immediate threat has been neutralized.

If you visited this site or entered any personal or financial information, act quickly. Change passwords on any accounts that may have been compromised, enable two-factor authentication, and monitor your cryptocurrency wallets and bank accounts for unauthorized transactions. Contact your financial institutions and consider reporting the incident to local cybercrime authorities. Staying vigilant and using trusted security tools can help protect against future threats like this crypto drainer.