claim-yooldo[.]org

Analysis of claim-yooldo.org indicates a high-risk crypto drainer phishing domain registered on December 4, 2025, through Cloudflare, Inc. The domain resolves to IP 172.67.157.199 (AS13335, Cloudflare, Inc., US) and uses Cloudflare nameservers adele.ns.cloudflare.com and drake.ns.cloudflare.com. SSL certificate issued by Google Trust Services (WE1) is present, though this does not mitigate the phishing risk. The domain is currently offline, returning HTTP 403 status, and its page title is flagged by Cloudflare as 'Suspected phishing site.' Google Safe Browsing classifies this domain under social engineering, and it appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

AlienVault OTX includes this domain in one threat intelligence pulse, confirming its malicious classification. Fifteen of 95 security vendors on VirusTotal detect this domain as malicious, though the exact nature of the crypto drainer payload remains unconfirmed due to the site's offline status. Defenders should treat this domain as compromised and block all resolutions at the DNS level.

The use of Cloudflare infrastructure and HTTP/3 suggests attempts to evade detection, but the domain's inclusion in multiple blocklists and threat intelligence feeds provides actionable indicators for mitigation. No brand impersonation details are available from the page title or known intelligence, limiting attribution beyond the crypto scam classification.