# drift-safe.com — SUSPICIOUS

> drift-safe.com is a live crypto drainer impersonating the Drift exchange (0/95 VirusTotal detections). Stop transactions immediately.

## Summary
PhishDestroy identifies drift-safe.com as a live crypto drainer actively harvesting wallet credentials and tokens from unsuspecting users. This domain mimics the legitimate Drift exchange to trick traders into connecting wallets or signing malicious transactions. As of seed d5423b, the campaign remains active and under investigation by multiple threat intelligence teams.

This domain was flagged by 2 of 95 VirusTotal vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 01, 2026, and resolves to IP 188.114.97.3. It carries a Let's Encrypt SSL certificate but is already blocked by SEAL and MetaMask, indicating early-stage detection across security platforms. The low VirusTotal score suggests the payload is either highly evasive or newly deployed, requiring immediate user caution.

Users must avoid interacting with drift-safe.com or any unsolicited links claiming to offer Drift exchange services. Verify all URLs against the official drift.trade domain before connecting wallets or signing transactions. Report any suspicious activity to your wallet provider and consider revoking wallet approvals if you have already connected to this domain. Exercise extreme caution with crypto transactions and rely only on verified, official platforms.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-04-01 21:39:46
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["SEAL", "MetaMask"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/drift-safe.com
- PhishDestroy: https://phishdestroy.io/domain/drift-safe.com/
- LLM endpoint: https://phishdestroy.io/domain/drift-safe.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/drift-safe.com/
Last updated: 2026-04-05