d1h15pcg1cec739sr730[.]ecardalert[.]com

PhishDestroy identifies d1h15pcg1cec739sr730.ecardalert.com as an active crypto drainer domain engaged in credential theft and crypto fund misappropriation. This domain is currently under investigation but remains operational, posing an elevated risk to potential victims. The threat actor leverages deceptive domains to impersonate legitimate cryptocurrency services, tricking users into connecting their wallets or divulging sensitive credentials under false pretenses.

This domain was flagged by 14 of 95 VirusTotal vendors, indicating it has evaded detection by most security solutions despite its malicious nature. Registered through MarkMonitor, Inc., the domain resolves to IP address 52.204.246.179 and was created on March 03, 2009, suggesting long-term ownership and potential for sustained misuse. The domain appears on 3 security blocklists, including OpenPhish, PhishingArmy, and PhishingDB, highlighting its known association with phishing infrastructure. Despite the lack of VirusTotal detections, the combination of blocklist entries and suspicious registration details underscores its malicious intent.

Given the active status and the specific threat posed by this crypto drainer domain, PhishDestroy recommends exercising extreme caution when encountering this domain or any associated links. Users should avoid interacting with the domain, refrain from entering credentials or connecting cryptocurrency wallets, and report any suspicious activity to relevant authorities or security teams. Organizations are advised to block this domain at the network level and update their threat intelligence feeds to include this indicator of compromise.