web3-wallet[.]devarif[.]me

PhishDestroy identifies web3-wallet.devarif.me as an active crypto drainer domain masquerading as a legitimate Web3 wallet service. The domain employs a fraudulent 'crypto_drainer' kit designed to deceive users into connecting their cryptocurrency wallets, enabling unauthorized transfers of digital assets. While the domain mimics wallet-related branding, no legitimate blockchain or financial service operates under this exact naming convention, indicating clear malicious intent from inception.

This domain was flagged by PhishDestroy with zero detections on VirusTotal (1/95) as of the latest scan. Technical indicators include registration through NAMECHEAP INC, a Let's Encrypt SSL certificate, a creation date of December 12, 2020, and resolution to IP 64.29.17.65. The domain remains unblocked by Google Safe Browsing (GSB) and has not been listed on any major threat intelligence blocklists. The absence of detections suggests either a newly deployed campaign or a sophisticated evasion technique to bypass initial scanning.

Currently, the domain is classified as 'active' with a risk level of 'under_investigation,' indicating ongoing monitoring but unresolved definitive attribution. Immediate action for users includes avoiding all interactions with web3-wallet.devarif.me and blocking the associated IP 64.29.17.65 at the network perimeter. While the current threat profile remains unconfirmed by broader security vendors, the combination of unflagged status, aging domain registration, and crypto drainer activity presents a high-risk scenario. No official takedown or mitigation has been confirmed, leaving potential exposure for cryptocurrency users who may inadvertently connect their wallets.