1756402135[.]zrmvdefi[.]top

This investigation documents the infrastructure associated with 1756402135.zrmvdefi.top, a domain classified as a crypto drainer. The domain was registered on February 21, 2026 and resolves to the IPv4 address 3.167.152.31, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to the United States. VirusTotal analysis records two positive detections out of ninety‑three scanned security engines, indicating limited but non‑trivial recognition by threat‑intelligence services.

The site has been added to at least one public security blocklist and is actively blocked by the PhishDestroy filtering platform. TLS inspection reports a certificate labeled “WE1”, suggesting a publicly issued SSL certificate without further validation details. Current network scans show the host is offline, and no HTTP response was observed at the time of assessment, limiting real‑time behavioral observation.

The available evidence confirms the domain’s role in a cryptocurrency‑draining campaign, yet the specific payload delivery mechanisms, victim targeting patterns, and command‑and‑control endpoints remain unverified. Defensive operators should continue to block the domain at DNS and proxy layers, monitor outbound traffic to the associated Amazon IP range for anomalous connections, and incorporate the two VirusTotal detections into existing indicator‑of‑compromise (IoC) feeds. Ongoing threat‑intel correlation is advised to capture any re‑activation attempts or related infrastructure sharing.