verification[.]walletpinet[.]com

This domain, verification.walletpinet.com, operates as a crypto drainer phishing site targeting cryptocurrency wallet users. Analysis indicates it impersonates legitimate wallet services under the guise of 'Wallet - PiNet' to trick victims into connecting their wallets, enabling unauthorized transactions that siphon funds to attacker-controlled addresses. The threat specializes in draining assets from connected wallets, particularly those using browser-based extensions or mobile applications, with no recovery mechanism for victims once transactions are executed. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 27, 2024, through Nhan Hoa Software Company Ltd., and resolved to IP address 210.245.90.206 (AS18403, FPT Telecom Company, Vietnam). Security vendors on VirusTotal flagged the domain in 12 out of 95 scans, while one additional security blocklist has listed it. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious infrastructure. The domain has since been taken offline, though residual risk remains for users who interacted with it prior to deactivation. Users who visited verification.walletpinet.com or connected a wallet to the site should immediately revoke any active wallet connections and transfer remaining assets to a new, secure wallet. Audit all recent transactions for unauthorized activity, particularly those involving token approvals or contract interactions. If funds were lost, report the incident to relevant blockchain explorers and law enforcement with transaction hashes and timestamps. Monitor connected devices for additional malware, as crypto drainers often deploy secondary payloads to maintain persistence or harvest credentials.