pontemnetwork[.]trade

This domain, pontemnetwork.trade, is identified as a crypto drainer phishing site targeting users of the Pontem blockchain platform. Analysis indicates the infrastructure is designed to impersonate legitimate Pontem services, tricking victims into connecting wallets to malicious smart contracts that drain funds. No specific drainer kit has been conclusively linked to this domain, but the use of Vue.js and Cloudflare suggests a modern, obfuscated attack framework. The page title "Pontem" further supports the brand impersonation angle, likely leveraging social engineering to exploit user trust. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 23, 2026, through NameSilo, LLC, and resolves to IP address 188.114.96.3. Google Safe Browsing has flagged the domain with a "SOCIAL_ENGINEERING" classification. Despite its malicious intent, the domain has not yet been flagged by VirusTotal, showing 0 detections out of 95 engines. It appears on four security blocklists, including MetaMask and PhishDestroy, and employs a Let's Encrypt SSL certificate for HTTPS encryption. Technologies detected include YouTube embeds, Vue.js for dynamic content rendering, and Cloudflare Browser Insights for performance monitoring. The domain is currently offline, likely taken down due to security interventions or registrar enforcement. However, residual risk remains as threat actors may re-deploy the infrastructure under a new domain or IP. Users who interacted with the site should immediately revoke wallet permissions, check for unauthorized transactions, and monitor connected accounts for suspicious activity. Organizations are advised to update blocklists with the provided indicators and educate users on recognizing crypto drainer tactics, such as unsolicited wallet connection requests or fake airdrop promotions.