claims-ondofinance[.]xyz

claims-ondofinance.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to IP 104.21.32.83, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. DNS is served by the Cloudflare name servers jaxson.ns.cloudflare.com and samara.ns.cloudflare.com. No TLS certificate is presented, indicating that the site does not provide HTTPS encryption. The page title returned by the server is “Just a moment…”, and the site is currently offline.

Threat intelligence marks the domain as a crypto‑scam that impersonates the Lido brand. VirusTotal reports that five of ninety‑three scanning engines have flagged the domain as malicious, and PhishDestroy has added it to its blocklist. The domain also appears on a single external security blocklist and received a Gridinsoft trust score of zero out of one hundred, reinforcing the malicious assessment. Analysis confirms that the infrastructure relies on a shared Cloudflare hosting environment, which can obscure the ultimate backend server but does not mitigate the observed malicious intent. The lack of an SSL certificate and the generic page title suggest a placeholder or redirect page rather than a fully deployed phishing site, yet the detection counts and blocklist entries indicate active abuse.

The exact nature of the payload or any credential‑stealing infrastructure has not been observed, and no additional evidence such as malicious URLs or sample files has been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and add the IP address 104.21.32.83 to relevant threat‑intel feeds. Because the domain is hosted on Cloudflare, any future re‑use of the same IP range may warrant broader scrutiny. Regularly updating URL filtering and employing threat‑intelligence‑driven controls will help mitigate the risk posed by this brand‑impersonation campaign.