claimyourgift[.]holyfiberworldwide[.]com

This domain, claimyourgift.holyfiberworldwide.com, is flagged as an active brand impersonation threat targeting WhatsApp users. Registered on September 6, 2023, the domain remains operational as of July 12, 2026, resolving to IP 172.64.152.166 (AS13335, Cloudflare, Inc., US). Infrastructure analysis reveals the use of Cloudflare nameservers (harvey.ns.cloudflare.com, nena.ns.cloudflare.com) and technologies including Node.js, Vue.js, Nuxt.js, libphonenumber, and Google Cloud services. The domain hosts a cryptocurrency scam, though the exact mechanics—whether a fake giveaway, wallet drainer, or investment fraud—are not yet confirmed. A single security vendor on VirusTotal has flagged the domain, while one blocklist (PhishDestroy) has already classified it as malicious. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as the domain continues to return an HTTP 200 status, indicating an active and accessible endpoint. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where WhatsApp-related phishing poses a risk. Monitoring for related infrastructure (e.g., subdomains, shared IPs, or co-occurring Cloudflare-protected domains) may uncover additional threat vectors. Given the domain’s age and persistence, it is likely part of a broader campaign; however, no direct links to other known threat clusters have been established at this time.