goldpocket[.]click

PhishDestroy identifies goldpocket.click as an active crypto drainer phishing domain designed to siphon cryptocurrency from unwitting users. The site masquerades as a legitimate wallet service, tricking victims into connecting malicious smart contracts that silently approve and drain wallet balances. Threat actors registered the domain on August 12, 2025, and leveraged a Google Trust Services SSL certificate to enhance credibility. The infrastructure is hosted on IP 188.114.96.3, which aligns with known malicious activity patterns seen in cryptocurrency theft campaigns.

This domain was flagged by 13 of 95 security vendors on VirusTotal, indicating elevated detection across multiple threat intelligence platforms. Goldpocket.click was registered through Gname.com Pte. Ltd. and currently shows no active blocklisting in Google Safe Browsing (GSB). The domain’s recent creation and association with a large-scale cryptocurrency drainer kit signal a coordinated and rapidly evolving threat targeting digital asset holders.

As of today, goldpocket.click remains active and poses a significant risk to cryptocurrency users. Immediate action is recommended to block the domain at the network and DNS levels, and users are urged not to interact with any links or interfaces associated with this site. The threat remains elevated due to the recent registration, SSL certificate trust, and partial detection coverage. Continued monitoring and proactive defense are essential to mitigate potential losses.