dorlnewebidkonfimasih1odiahterpendinggg[.]kart4claim[.]biz[.]id

PhishDestroy identifies dorlnewebidkonfimasih1odiahterpendinggg.kart4claim.biz.id as an active, high-risk crypto drainer campaign targeting cryptocurrency users. The domain employs deceptive lures—likely mimicking legitimate Web3 airdrop or giveaway pages—to trick victims into connecting wallets and approving malicious transactions. Once connected, the drainer silently transfers approved tokens to attacker-controlled addresses, often exploiting ERC-20 or BEP-20 token approval mechanisms. This is not a generic phishing page but a specialized tool designed to extract funds from compromised wallets within seconds of interaction. This domain was flagged by multiple threat intelligence platforms, demonstrating consistent malicious behavior across the ecosystem. It appears on 2 security blocklists, including OpenPhish and PhishingArmy, and is blocked by Google Safe Browsing under the SOCIAL_ENGINEERING category. VirusTotal analysis reveals 23 of 95 security vendors detect this domain as malicious, indicating widespread recognition of its harmful intent. The domain resolves to IP address 172.67.135.22 and uses a Let's Encrypt SSL certificate, which, while valid, is frequently abused in fraudulent campaigns to appear legitimate. Notably, the seed identifier 051e72 links this domain to a known family of crypto drainers observed in multiple active campaigns during early 2024. Users must treat this domain with extreme caution. If you’ve visited this domain or connected your wallet, immediately revoke all token approvals using tools like revoke.cash or your wallet’s built-in allowance manager. Do not interact with any suspicious links promising free crypto, giveaways, or urgent claims. Enable wallet transaction simulation features if available, and consider using hardware wallets for high-value assets. Report the domain to your security provider and blocklist maintainers—include the IP (172.67.135.22) and domain for broader protection. Stay vigilant: crypto drainers like this often spread through social media ads, impersonated websites, and fake support channels. Always verify URLs and never approve transactions from untrusted sources.