buffmarket[.]at

PhishDestroy identifies the domain buffmarket.at as an active crypto drainer under investigation, operating under a generic phishing threat profile. The site is currently unresolved pending deeper forensic analysis, but behavioral indicators strongly suggest malicious intent targeting cryptocurrency users through deceptive asset transfer mechanisms.

This domain resolves to IP address 104.21.92.221 and utilizes a Google Trust Services SSL certificate, which is commonly exploited in phishing campaigns to appear legitimate. PhishDestroy’s analysis confirms that 3 out of 95 VirusTotal security vendors currently flag this domain, indicating a critical detection gap in automated scanning systems. The domain is registered through Hosting Concepts B.V. (Registrar.eu) via nic.at, a registrar known for hosting high-risk domains. While the exact creation date is not provided in public WHOIS records, the domain’s infrastructure aligns with recently observed crypto drainer campaigns impersonating established brands.

As the domain remains under investigation with an active status, PhishDestroy advises immediate caution: block the domain at the DNS and network levels, scan all endpoints for unauthorized cryptocurrency wallet connections, and flag any outbound traffic to 104.21.92.221. Users who have interacted with this domain should revoke any connected wallet permissions and transfer remaining assets to secure, offline storage. Report indicators to your threat intelligence platform with high severity due to the absence of vendor detection.