mutuumstake[.]sbs

This domain, mutuumstake.sbs, is identified as a high-risk crypto drainer operation designed to impersonate Mutuum Finance, a legitimate decentralized finance platform. Analysis indicates the site employs malicious scripts to automatically siphon cryptocurrency assets from connected wallets, a tactic consistent with advanced drainer kits observed in recent campaigns. The domain’s infrastructure and behavioral patterns align with known wallet-draining malware, posing an immediate threat to users who interact with its interface. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 104.21.37.49 and was registered on February 21, 2024, through Dynadot LLC. Detection metrics show 15 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on eight distinct security blocklists. The site employs Cloudflare for hosting and protection, alongside HSTS and HTTP/3 protocols, which may obscure further analysis. Google Trust Services issued the SSL certificate, adding a superficial layer of legitimacy despite the domain’s fraudulent intent. As of the latest assessment, mutuumstake.sbs has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, the risk of reemergence remains high, as threat actors frequently redeploy similar domains under new registrations. Users are advised to verify domain authenticity through official channels before connecting wallets and to monitor for unauthorized transactions. The presence of this domain on multiple blocklists underscores the necessity of real-time threat intelligence integration to mitigate exposure to such drainer operations.