eidoo-wallet[.]io

This domain, eidoo-wallet.io, is actively flagged as part of a crypto drainer operation targeting cryptocurrency wallet users. Infrastructure analysis reveals the domain was registered on March 15, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.96.3, hosted on Cloudflare nameservers (eugene.ns.cloudflare.com and savanna.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 29, 2026, five out of ninety-one security vendors on VirusTotal detect this domain as malicious, indicating moderate but not universal recognition of the threat.

The domain appears on at least one security blocklist and is explicitly blocked by PhishDestroy, further corroborating its malicious classification. Defenders should note that the specific content or wallet interaction mechanisms of this site have not been fully analyzed, but the classification as a crypto drainer suggests it is designed to siphon funds from connected wallets. The use of Cloudflare infrastructure complicates traditional IP-based blocking, requiring defenders to rely on domain-level indicators for mitigation. No SSL or HTTP status anomalies are reported, but this does not diminish the threat, as malicious actors frequently maintain technically sound infrastructure to avoid detection.

The domain's creation date, registrar, and hosting pattern align with known crypto drainer campaigns, and its continued activity despite partial vendor detection underscores the need for proactive blocking. Organizations should treat this domain as high-risk and prioritize its inclusion in endpoint protection, web filtering, and threat intelligence feeds. Further investigation into associated wallet addresses, transaction patterns, or linked domains may reveal broader campaign infrastructure.