ordo-claims[.]com

This domain, ordo-claims.com, is identified as an active crypto drainer phishing infrastructure designed to compromise cryptocurrency wallets through credential harvesting and unauthorized transaction execution. Analysis indicates the domain is currently operational and poses a high-risk threat to users interacting with decentralized finance platforms or wallet services. No legitimate brand impersonation has been confirmed, though the domain employs deceptive naming conventions typical of fraudulent claim portals. Infrastructure analysis reveals the domain was registered on May 23, 2026, through NameCheap, Inc., an entity frequently associated with malicious registrations. It resolves to the IP address 172.66.2.113, which has been linked to other phishing campaigns targeting financial assets. Detection metrics show minimal coverage, with only 1 of 95 security vendors flagging the domain on VirusTotal, while it appears on three independent security blocklists. The absence of an SSL certificate further reduces its legitimacy, as modern secure connections are a baseline expectation for financial interactions. Additional protective measures include blocking by multiple wallet security protocols, indicating prior malicious activity. Current status confirms ordo-claims.com remains active, with no takedown or mitigation efforts observed as of this analysis. Users are advised to treat the domain as hostile and avoid interaction entirely. Network administrators should implement DNS-based blocking for 172.66.2.113 and monitor for related domains registered through the same registrar. Cryptocurrency wallet users should verify transaction prompts independently and enable multi-factor authentication where available. Given the domain’s creation date discrepancy—registered in 2026—further scrutiny of registration timestamps is recommended to identify potential fraudulent patterns.