readywallet[.]co

This domain, readywallet.co, is identified as a crypto drainer operation designed to illicitly siphon cryptocurrency assets from victim wallets. Analysis indicates the absence of brand impersonation, suggesting a direct attack vector targeting users through deceptive transaction prompts or wallet connection requests. The infrastructure shows no affiliation with legitimate wallet services, reinforcing its malicious intent. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on September 25, 2025, and resolves to the IP address 198.18.0.94, hosted on Amazon.com, Inc. (AS16509). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious actors. VirusTotal detection metrics report 11 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No Google Safe Browsing (GSB) entries were identified at the time of analysis. The domain has been taken offline, reducing immediate risk of direct exploitation. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the domain prior to its takedown should assume wallet compromise and take immediate action: revoke all connected dApp authorizations, transfer remaining assets to a new wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists with the domain and associated IP to prevent future exposure.