claim-oilless[.]lol

On July 24, 2026, analysis of the domain claim-oilless.lol indicates it was used as a crypto drainer employing an airdrop‑style scam kit. The site’s HTML title reads "OILLESS | AirDrop", confirming the use of an airdrop‑themed lure. The domain was registered on 11 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served via Cloudflare DNS (nameservers amos.ns.cloudflare.com and maya.ns.cloudflare.com). Infrastructure inspection shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate was presented, indicating the site operated over plain HTTP, while HTTP/3 was observed during connection attempts, and the page loads Bootstrap‑based assets and Cloudflare Browser Insights scripts. VirusTotal scans recorded two detections out of ninety‑four vendors, and the domain appears on a single security blocklist.

PhishDestroy has already added the domain to its blocklist, and the same blocklist entry is reflected in public threat feeds. The site’s status at the time of analysis was offline, suggesting the operators have taken the site down or are rotating infrastructure. Because the site is no longer reachable, detailed content analysis beyond the page title is not available, and no additional malicious payloads have been captured. No SSL certificate means no certificate pinning data, and no HTTP response codes are observable. Defenders should block DNS resolution for claim‑oilless.lol and the associated IP 188.114.96.3 at network perimeter and endpoint controls. Monitoring of Cloudflare‑hosted IP ranges for re‑use of the same address by new crypto‑drainer campaigns is advised.

Adding the domain to URL filtering, email security, and web proxy blocklists will prevent accidental user exposure. Since the kit is identified as an "Airdrop Scam", security teams should also watch for similar lure strings (e.g.