decetnraland[.]net

PhishDestroy identifies decetnraland.net as an active brand impersonation site posing as Decentraland, likely embedding a crypto drainer to steal cryptocurrency assets. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 30, 2025, and currently resolves to IP 188.114.96.3. Despite its recent creation, the domain has not yet triggered any detections across 95 VirusTotal scanners, underscoring the importance of proactive threat hunting and user vigilance. The presence of a Google Trust Services SSL certificate further enhances its deceptive legitimacy.

Technical analysis confirms a high-risk impersonation pattern targeting Decentraland users, leveraging a visually similar domain name to mislead visitors into connecting crypto wallets or engaging with malicious smart contracts. The lack of detection on VirusTotal (0/95) suggests this threat may still be in early deployment or leveraging obfuscated payloads to evade antivirus engines. Registrar data and IP association provide reliable pivot points for network defenders to identify related infrastructure. Given the active status and low detection rate, this domain represents a credible threat to cryptocurrency users.

Users who visited decetnraland.net are strongly advised to immediately disconnect any connected wallets and revoke permissions via blockchain explorers or wallet interfaces. Run a full system scan with updated antivirus software and clear browser cache and cookies. Report the domain to your security team or threat intelligence platforms and avoid reopening links from unsolicited messages referencing Decentraland. Monitor wallet and transaction activity for unauthorized transfers.