olympusdao[.]live

The domain olympusdao.live has been identified as a crypto drainer phishing site specifically designed to impersonate Olympus DAO, a decentralized finance protocol. This infrastructure is currently offline, though prior activity suggests it was engineered to execute unauthorized cryptocurrency transactions by deceiving users into connecting wallets to malicious smart contracts. Analysis indicates the domain was operational in a limited capacity before being taken down, though its short-lived presence raises concerns about targeted financial fraud campaigns. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on March 02, 2026, an unusually future-dated entry that may indicate falsified registration data or an error in public records. It resolved to the IP address 104.21.64.163, a Cloudflare-hosted endpoint utilizing HTTP/3 and secured with a Let’s Encrypt SSL certificate. Detection metrics show the domain was flagged by 0 of 95 VirusTotal vendors, indicating minimal prior scrutiny despite its appearance on one security blocklist. Additional indicators include a Gridinsoft trust score of 0/100 and a page title reflecting a Cloudflare 522 connection timeout error, suggesting abrupt deactivation or disruption of service. Current evidence confirms olympusdao.live is no longer accessible, though the underlying threat persists due to the domain’s registration remaining active. Users are advised to treat any prior interactions with the domain as compromised and immediately revoke permissions for connected wallets. Organizations should monitor for similar impersonation attempts leveraging the Olympus DAO brand, particularly those registered through NiceNIC or resolving to Cloudflare IPs. Proactive blocklisting of the domain and associated IP is recommended to prevent potential resurgence or lateral movement within phishing campaigns.