shadowpay[.]at

PhishDestroy flagged shadowpay.at as a generic phishing domain currently under investigation for hosting a cryptocurrency drainer kit. This domain mimics legitimate cryptocurrency services to deceive users into connecting wallets or entering credentials, which are then exploited to siphon digital assets. No specific brand or drainer kit variant has been confirmed yet, but the domain’s behavior aligns with known theft patterns targeting unsuspecting cryptocurrency users.

Exact technical indicators for shadowpay.at include a VirusTotal detection score of 0/95, indicating no current antivirus or security vendor flags despite its malicious intent. The domain is registered through Hosting Concepts B.V. via Registrar.eu, resolving to IP 188.114.97.3. Notably, it holds an SSL certificate issued by Google Trust Services, which may be leveraged to lend false legitimacy to phishing pages. The domain is actively resolving and remains unblocked by major threat intelligence platforms, increasing exposure to potential victims. While the creation date is unverified in available data, its active status and lack of detections suggest it is a recently deployed threat.

As of the latest assessment, shadowpay.at remains an active threat with a status of 'under_investigation' and a risk level yet to be finalized. PhishDestroy recommends immediate blocking of the domain and IP address 188.114.97.3 at the network perimeter to mitigate exposure. Users should avoid accessing the domain and report any interactions to their security teams. Remaining risk hinges on further analysis of its drainer kit and potential connections to broader phishing campaigns. The absence of detections and the use of a Google-issued SSL certificate underscore the need for heightened scrutiny and proactive threat hunting to prevent cryptocurrency theft.