zoemartinfleuriste[.]eu

This domain, zoemartinfleuriste.eu, is flagged as an active high-risk crypto drainer phishing site. Analysis indicates it is designed to harvest wallet credentials and drain cryptocurrency assets from victims by impersonating legitimate services. The threat type is classified as a crypto drainer, a specialized form of phishing that targets digital wallet connections and transaction approvals, often leading to irreversible financial losses. Infrastructure analysis reveals the domain resolves to the IP address 158.94.211.185 and was registered on May 24, 2026, through an unnamed registrar, suggesting a likely fraudulent or short-term registration pattern. The domain is currently active and presents a generic 'Domain Default page' as its page title, a common tactic to evade initial scrutiny while hosting malicious scripts. Detection metrics show 3 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued by Let's Encrypt (YR2), a legitimate provider often abused by threat actors to lend false credibility to phishing sites. Mitigation against this crypto drainer requires immediate action from both end-users and network administrators. Users should avoid interacting with the domain, particularly when prompted to connect wallets or approve transactions. Wallet software should be configured to reject connections from untrusted domains, and hardware wallets should be used for high-value transactions to prevent unauthorized access. Network-level protections, such as DNS filtering or IP-based blocking of 158.94.211.185, are recommended to prevent access to the domain. Security teams should monitor for related indicators, including the domain's creation date and associated IP, to identify potential infrastructure reuse in future campaigns.