yfc55[.]net

PhishDestroy has identified yfc55.net as a generic phishing domain with an elevated risk level, currently offline. This domain was specifically designed as a crypto drainer, targeting users by impersonating legitimate cryptocurrency platforms to steal wallet credentials and drain funds. The domain's title was simply "欢迎" ("Welcome" in Chinese), a common tactic to appear innocuous while hosting malicious scripts.

Technical indicators paint a clear picture of intent. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. It resolves to IP 23.248.224.154 and appears on two separate security blocklists. The domain was created on February 16, 2017, through registrar 22net, Inc., and AlienVault OTX has recorded it in 16 threat intelligence pulses. Notably, the domain lacks an SSL certificate, further raising red flags for any legitimate service. Trust scores from multiple sources are critically low, and the domain has been taken offline, likely due to abuse reports.

Users who may have interacted with yfc55.net should immediately revoke any token approvals granted on the site using a revoke tool, change passwords for any accounts where credentials were entered, and enable two-factor authentication. For future safety, always verify URLs by checking the official domain of the service you intend to use, and rely on PhishDestroy's real-time blocklist to avoid connecting wallets or entering sensitive information on phishing domains. If you suspect funds were drained, contact your wallet provider and consider freezing affected assets.