firstmerchantsbank[.]at

This domain is flagged as a high-risk crypto wallet drainer designed to impersonate MetaMask, a widely used cryptocurrency wallet service. Analysis indicates the site employs brand impersonation techniques to deceive users into disclosing sensitive wallet credentials or executing unauthorized transactions, leading to direct financial theft. The threat type is classified as a crypto wallet drainer due to its focus on extracting digital assets from compromised wallets, rather than generic credential theft or broad phishing tactics. Infrastructure analysis reveals the domain firstmerchantsbank.at was registered on February 21, 2026, through the registrar Digi-cloud, an entity frequently associated with high-risk domains. The domain resolves to the IP address 91.199.163.57, which has been linked to multiple malicious campaigns in recent threat intelligence reports. Detection metrics further corroborate its malicious nature, with 17 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and has been assigned a trust score of 0 out of 100 by Gridinsoft. The page title, First Merchants Bank | Helping You Prosper, is a clear attempt to mimic legitimate financial institutions, despite the domain’s primary targeting of MetaMask users. Technologies detected on the site include Nginx, a web server commonly used in both legitimate and malicious infrastructure. Mitigation against this threat requires immediate action from both end users and security teams. Users who may have interacted with the domain should revoke any connected wallet permissions and transfer assets to a new, secure wallet. Security teams are advised to block the domain, its resolving IP address (91.199.163.57), and any associated indicators of compromise at the network perimeter. Organizations should also monitor for unauthorized transactions or wallet access originating from internal networks. Given the domain’s offline status, continuous monitoring for re-registration or re-emergence under a different name is recommended. Awareness campaigns highlighting the risks of crypto wallet drainers and brand impersonation tactics should be prioritized to prevent further victimization.