claim[.]yofinance[.]xyz

This domain, claim.yofinance.xyz, operates as a crypto drainer phishing site designed to deceive users into connecting their cryptocurrency wallets under the guise of a legitimate token or reward claim. Once a user interacts with the site, malicious scripts execute to drain funds from connected wallets by exploiting permissions granted during the connection process. The threat primarily targets users of decentralized finance (DeFi) platforms, leveraging social engineering tactics to trick victims into authorizing transactions that transfer assets to attacker-controlled addresses. Analysis indicates the domain was registered on April 23, 2026, through NameSilo, LLC, a registrar frequently associated with low-reputation domains. It resolves to the IP address 188.114.96.3 and holds a Gridinsoft trust score of 0/100, reflecting its high-risk nature. Security vendors on VirusTotal flagged the domain at a rate of 15/95, with detections including malicious URL, phishing, and crypto-related fraud. The domain appears on one security blocklist and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate while masking its fraudulent intent. Its current offline status suggests takedown efforts, though similar domains may re-emerge under different names. If you visited claim.yofinance.xyz or interacted with its content, immediate action is required to mitigate potential losses. First, disconnect any wallets linked to the site by revoking permissions via your wallet’s connected apps or dApp browser settings. Next, transfer remaining assets to a new, secure wallet address not previously exposed to the phishing site. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain explorers or fraud tracking platforms. Users should also scan their devices for malware, as some crypto drainers deploy additional payloads to maintain persistence or harvest further credentials.