claims-floki[.]pages[.]dev

The domain claims-floki.pages.dev is identified as a high-risk brand impersonation threat, specifically targeting Yahoo. This domain is associated with phishing activities, leveraging the brand recognition of Yahoo to deceive users. The page title 'Floki | The People's Crypto | $Floki' suggests the usage of a cryptocurrency theme to mislead users into believing they are accessing legitimate services related to Yahoo.

Technical analysis reveals that the domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.47.19. It was created on March 23, 2024, and is located in the US under AS13335, which is associated with Cloudflare, Inc. Notably, the domain has a VirusTotal detection score of 15 out of 95 security vendors flagging it as malicious. Moreover, it appears on three security blocklists and has been blocked by services such as PhishDestroy, ScamSniffer, and Enkrypt. The SSL certificate is issued by Google Trust Services / WE1, which is commonly used for legitimate purposes, potentially adding a layer of false security to unsuspecting users.

Currently, the domain remains active, posing an ongoing risk to users who may be deceived by its appearance and the impersonation of a well-known brand. Security professionals recommend that users exercise caution and verify the authenticity of web pages before providing sensitive information. Organizations should update their blocklists and inform users about this active threat to minimize exposure and potential harm. Continuous monitoring of this domain is advised to ensure prompt action if further malicious activities are detected.