web3[.]medinavaseattle[.]com

This domain is flagged as a high-risk crypto drainer, a specialized phishing threat designed to exploit Web3 wallet connections and siphon cryptocurrency assets. Analysis indicates the site employs deceptive smart contract prompts or wallet signature requests to trigger unauthorized transactions, a tactic increasingly observed in decentralized finance (DeFi) scams. The domain's infrastructure and lack of security controls further support its classification as a targeted financial threat rather than opportunistic credential theft. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 27, 2026, through Ultahost, Inc., and currently resolves to IP address 192.142.10.5, hosted on AS214036 (Ultahost, Inc.) in the Netherlands. No SSL certificate is present, increasing the likelihood of man-in-the-middle interception or plaintext credential exposure. The domain appears on one security blocklist (PhishDestroy) and is detected by 2 of 95 security vendors on VirusTotal, suggesting limited but confirmed malicious activity. The future-dated registration (2026) may indicate an attempt to evade short-term reputation-based filtering or preemptive domain squatting for long-term campaigns. Mitigation requires immediate action from both end users and network defenders. Users should revoke any active wallet connections to web3.medinavaseattle.com via their wallet provider's interface and audit recent transaction histories for unauthorized transfers. Network-level protections should include DNS sinkholing for the domain and its resolving IP (192.142.10.5), as well as blocking outbound connections to AS214036 where feasible. Organizations handling Web3 assets should implement transaction simulation tools to flag suspicious contract interactions and enforce strict allowlisting for decentralized application (dApp) connections. Given the domain's active status and targeted nature, monitoring for related infrastructure (e.g., subdomains, shared hosting IPs) is recommended to preempt secondary attack vectors.