playprovidence[.]site

This domain, playprovidence.site, operates as a sophisticated phishing site designed to distribute malicious game launcher software. Analysis indicates the site mimics legitimate gaming platforms to trick users into downloading trojanized installers that contain crypto wallet drainer functionality. The threat specifically targets gamers by presenting itself as a survival-crafting game client, while covertly deploying payloads that monitor and exfiltrate cryptocurrency wallet credentials and private keys from infected systems. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited, a registrar frequently associated with phishing operations. VirusTotal detection shows 12 out of 95 security vendors flagging the domain as malicious, with specific classifications including trojan distribution and crypto theft. The domain appears on three security blocklists and resolves to IP address 104.21.91.131, hosted on Cloudflare infrastructure (AS13335). The SSL certificate issued by Google Trust Services (WE1) was likely obtained through automated domain validation processes common in phishing campaigns. Users who visited playprovidence.site or downloaded any files from the domain should immediately disconnect affected devices from networks and perform a full system scan using updated security tools. All cryptocurrency wallets accessed from compromised devices should be considered at risk, requiring immediate transfer of funds to new wallets with fresh seed phrases. Browser data including cookies, saved passwords, and extension states should be cleared, as the malware may have captured authentication tokens. System restore or complete OS reinstallation is recommended for devices where executable files were downloaded or executed from this domain.