claim[.]wizardao[.]eth[.]limo

The domain claim.wizardao.eth.limo was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IP address 3.135.72.151, which is hosted in the United States under ASN 16509 (Amazon.com, Inc.). The authoritative name servers are ns-814.awsdns-37.net, ns-1689.awsdns-19.co.uk, ns-48.awsdns-06.com, and ns-1 (partial). The site presents a page titled “The WizarDAO Token Minter” and is classified as a crypto_drainer, indicating an intent to illicitly acquire cryptocurrency assets. Infrastructure analysis shows the server supports HTTP/3, enforces HSTS, and serves content over IPFS, with a valid Let’s Encrypt/E7 TLS certificate and an HTTP 200 response. The domain is listed on one security blocklist, has a Gridinsoft trust score of 0/100, and is currently blocked by PhishDestroy. No detections were reported by VirusTotal, but the absence of alerts does not constitute a safety assurance. The threat remains active and under investigation. Defenders should add the domain and its resolved IP to outbound and inbound blocklists, monitor DNS queries for the associated nameservers, and consider sinkholing the IP address to disrupt potential crypto‑draining activity. Ongoing observation is required to determine whether additional infrastructure or payloads are associated with this campaign.