claim-fafo[.]pages[.]dev

Analysis of claim-fafo.pages.dev indicates it was a crypto drainer phishing domain, operational as recently as July 2026. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to IP 172.66.44.193 (AS13335, Cloudflare, Inc., US). No SSL certificate was present at the time of assessment, increasing the risk of unencrypted data interception. The page title, 'FAFO - Fuck Around and Find Out,' aligns with known crypto scam branding tactics, though specific content beyond the title remains unanalyzed.

The domain was flagged by 3 of 93 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and ScamSniffer. Its status is currently offline, but prior activity suggests it was part of a broader crypto drainer campaign targeting wallet credentials or transaction approvals. Infrastructure analysis reveals Cloudflare hosting, a common choice for phishing sites due to its accessibility and proxy services. Defenders should treat this domain as compromised.

Blocklist the domain and IP at perimeter security controls, and monitor for related indicators such as the registration date, hosting provider, or page title patterns. While offline, the domain may resurface under similar naming conventions or infrastructure. No further brand or kit details are confirmed, and the exact victim targeting remains unclear. If historical logs exist, review for connections to 172.66.44.193 or the domain during its active period.