yolood[.]xyz

Analysis of yolood.xyz, a domain first observed on December 02, 2025, indicates an active crypto‑scam infrastructure that was taken offline prior to the report date of July 23, 2026. The site presented the page title "Yolood: Most Popular Online Crypto Casino Based on Blockchain" and leveraged the publicly available Gambler Scam phishing kit, suggesting a targeted effort to lure cryptocurrency users. Technical profiling shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. No SSL certificate was detected, leaving the HTTP connection unencrypted and vulnerable to interception.

The registrar is listed as Web Commerce Communications Limited, and the domain is configured with Cloudflare nameservers lily.ns.cloudflare.com and mark.ns.cloudflare.com. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence rating. VirusTotal scanned the domain with 93 security engines, of which 12 reported detections, confirming that multiple vendors consider the site malicious. The domain appears on one known security blocklist and has been flagged by PhishDestroy.

While the infrastructure details, such as the use of Cloudflare’s CDN, are clear, the full scope of the phishing campaign—including any compromised user accounts or financial losses—remains unknown due to the site’s offline status. Defenders should continue to block yolood.xyz at perimeter firewalls, DNS resolvers, and endpoint protection solutions, monitor for any related C2 IP activity originating from 188.114.96.3, and audit logs for traffic to Cloudflare edge nodes that may indicate residual activity. Ongoing intelligence collection is recommended to capture any re‑hosting attempts or related domains that reuse the same phishing kit or registrar details.