mainnetvalidatordapps[.]netlify[.]app

The domain mainnetvalidatordapps.netlify.app has been confirmed as a crypto drainer phishing site targeting cryptocurrency users. Analysis indicates the infrastructure was designed to mimic decentralized application (dApp) validation interfaces, likely to trick victims into authorizing malicious transactions that drain wallet funds. The domain is currently offline, though prior activity suggests it may have been operational during a limited window for targeted attacks. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Name.com, Inc., and hosted on Netlify’s platform. It resolved to the IP address 35.157.26.135, located in Germany under Amazon.com, Inc.’s AS16509. The domain appears on one security blocklist and is flagged by 10 of 95 security vendors on VirusTotal, indicating moderate but consistent detection. The SSL certificate was issued by DigiCert Inc, specifically under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, which is commonly used for both legitimate and malicious sites. The page title, 'Site not found,' suggests the content was either removed or never fully deployed, though historical captures may reveal active phishing components. Current status shows the domain as offline, reducing immediate risk to users. However, the infrastructure remains a potential threat if reactivated. Organizations and individuals are advised to block the domain and associated IP at the network level. Cryptocurrency users should revoke any suspicious dApp authorizations and monitor wallet activity for unauthorized transactions. Security teams should treat domains with similar naming patterns (e.g., 'mainnetvalidator,' 'dapps') as high-risk and prioritize monitoring for related phishing campaigns. Given the domain’s creation date in the future (2026), this may indicate either a typo or an attempt to bypass time-based detection filters, warranting further scrutiny of the registrar’s registration practices.