istake[.]us

istake.us is currently flagged as an active crypto‑drainer infrastructure. The domain was first observed by threat‑intel feeds in early 2026 and has since been added to the PhishDestroy blocklist. VirusTotal reports that 15 of 91 scanning engines have generated a malicious classification, indicating a moderate consensus among antivirus products. The domain also appears on a single external security blocklist, reinforcing the suspicion that it is being used for illicit cryptocurrency extraction.

Technical reconnaissance shows no publicly disclosed registrar information, SSL certificate details, or IP hosting data in the available intelligence. Safe Browsing status, Open Threat Exchange (OTX) entries, and trust‑score metrics have not been published for this host, limiting the depth of automated reputation checks. The HTTP response code and page title have not been captured, so the exact landing page content remains unverified.

Nonetheless, the combination of vendor detections and blocklist inclusion aligns with the classification of a crypto‑drainer campaign, where victims are typically lured into transferring cryptocurrency to attacker‑controlled wallets. Defenders should block istake.us at the DNS and proxy layers, monitor outbound traffic for connections to the domain, and instrument endpoint detections for the 15 associated malware signatures. Continuous re‑evaluation is advised as additional telemetry, such as hosting IPs or SSL fingerprints, may become available and refine attribution.