event-sunrisedefi[.]live

This domain, event-sunrisedefi.live, is identified as a crypto drainer infrastructure designed to siphon cryptocurrency assets from compromised wallets. Analysis indicates it employs malicious JavaScript to intercept and redirect transactions, a common tactic in drainer kits targeting decentralized finance (DeFi) platforms. While no explicit brand impersonation is confirmed, the domain name suggests an attempt to mimic legitimate DeFi projects, potentially exploiting user trust in similar-sounding services. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 2 out of 95 security vendors on VirusTotal, with a low detection rate likely due to recent deployment or evasion techniques. It was registered on June 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 188.114.97.3, a host that may be part of a content delivery network or bulletproof infrastructure. It appears on 2 security blocklists, and its SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy. No Google Safe Browsing (GSB) flags are currently reported. As of the latest assessment, event-sunrisedefi.live remains active and poses a high risk to users interacting with cryptocurrency wallets or DeFi platforms. The domain is blocked by wallet security extensions, indicating proactive mitigation efforts. However, the low VirusTotal detection rate and recent registration suggest it may evade some automated defenses. Users are advised to verify domain authenticity before connecting wallets, employ browser-based wallet security tools, and monitor transaction requests for unauthorized activity. Network-level blocking of the domain and its resolving IP is recommended for enterprise environments.