gift-yieldusd[.]org

gift-yieldusd.org was observed delivering a fraudulent investment front that claims to offer a self-custodial yield-generating stablecoin, as indicated by the page title "Yield Dollar - Self-Custodial Yield-Generating Stablecoin." The domain was registered on February 25, 2026 through NiceNIC International Group Co., Limited and is served by Cloudflare nameservers archer.ns.cloudflare.com and sue.ns.cloudflare.com. DNS resolution points to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented at the time of inspection, confirming the absence of HTTPS protection. The site was taken offline before the analysis was completed, and its HTTP status could not be captured. Multiple defenses have already flagged the domain.

PhishDestroy, MetaMask, and SEAL have added it to their blocklists, and it appears on three additional security blocklists. VirusTotal scanned the domain and recorded six positive detections out of ninety-three scanned security vendors, corroborating the suspicion of malicious intent. The classification in the intelligence set is "generic phishing" with a specific "investment scam" tag, suggesting that the operator is attempting to lure victims into depositing funds under the promise of high yields. While the infrastructure points to a legitimate content-delivery network (Cloudflare), the lack of a valid SSL certificate, the rapid registration date, and the presence on multiple blocklists indicate a high likelihood of abuse.

Current uncertainty includes the exact content served before takedown and any associated command-and-control infrastructure, which could not be extracted because the site is offline. Defenders should continue to block the domain at network perimeter devices, update DNS-based allow-lists to deny the resolved IP address 188.114.96.3 for this host, and monitor for any future re-registration attempts by the same registrar.