twitch[.]gift

The domain twitch.gift has been identified as a threat due to its involvement in brand impersonation, specifically targeting the Solana brand. The domain's page title, stream.gift, suggests a possible attempt to confuse users with legitimate streaming services to collect sensitive information under the guise of a known brand. No specific drainer kit has been identified, but the threat is significant enough to warrant attention given the brand's prominence.

Technical analysis of twitch.gift reveals several critical indicators. The domain is registered through NameCheap, Inc., and was created on May 25, 2024. It resolves to IP address 66.33.60.130, located in the United States, under the network AS16509 Amazon.com, Inc. The SSL certificate in use is issued by Google Trust Services / WE1. VirusTotal analysis shows 11 out of 95 security vendors currently flag this domain as malicious. Furthermore, it appears on 2 security blocklists and has been blocked by entities such as PhishDestroy and DiscordPhishing.

Currently, the domain status is offline, mitigating immediate risks of brand impersonation attacks. However, the past online status poses a potential for residual threats if users interacted with it before it was deactivated. Continuous monitoring of similar domain registrations and heightened awareness among potential Solana users are recommended to prevent future impersonation attempts. Regular updates to security blocklists and vigilance in detecting similar threats will reduce the likelihood of successful brand impersonation campaigns.