me[.]sahkoautot[.]info

me.sahkoautot.info is a recently active crypto drainer posing as the Finnish electric-vehicle site Sahkoautot.fi. When visited, the page attempts to trick users into connecting a wallet and signing a malicious transaction that drains tokens directly from the wallet. Criminals behind the domain use Let’s Encrypt certificates to appear legitimate and rely on generic-looking subdomains to evade simple blocklists. Security vendors have already blacklisted the host at 104.21.36.30, yet new visitors still land on the page every day. PhishDestroy’s records show this domain was first observed on public feeds on 2024-05-12 and is registered through Namecheap Inc. The site is currently detected by 18 out of 95 VirusTotal scanners, and it appears on four additional threat intelligence feeds including PhishingArmy, StevenBlack, OISD, and CERT-PL. Despite the takedown-resistant hosting on Cloudflare IP 104.21.36.30, the Let’s Encrypt certificate is only valid for the exact domain name, giving analysts an easy pivot for further hunting. If you or someone in your organization visited me.sahkoautot.info, immediately disconnect the device from the internet, revoke any wallet connections shown in your browser’s extension list, and transfer remaining funds to a newly created wallet. Scan the workstation with an up-to-date antivirus and reset browser profiles. Report the incident to your security team and include the domain, the timestamp, and any wallet addresses involved for rapid threat containment.