minecore[.]ltd

This domain, minecore.ltd, is identified as an active crypto drainer phishing site designed to compromise digital wallet credentials and siphon cryptocurrency assets. Analysis indicates the infrastructure is tailored to mimic legitimate blockchain interaction platforms, employing malicious JavaScript to execute unauthorized transactions upon user connection. No direct brand impersonation has been observed, but the site employs generic crypto-themed lures to deceive victims into exposing private keys or signing malicious payloads. Infrastructure analysis reveals the domain was registered on May 27, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious registrations. The domain is hosted on IP address 104.21.82.145, which has been linked to multiple phishing campaigns in recent months. As of the latest assessment, minecore.ltd is flagged by 7 out of 95 security vendors on VirusTotal, with detections including heuristic signatures for crypto-related fraud. The domain appears on three independent security blocklists, though it remains unlisted in Google Safe Browsing. Additional indicators include the use of Cloudflare proxy services to obfuscate the origin server and evade takedown efforts. The site remains operational despite partial mitigation efforts, including blocking by at least three security entities. The persistent status underscores the elevated risk to users, particularly those interacting with decentralized finance platforms. Endpoint protection systems are advised to update signatures to include this domain and its associated IP. Users are strongly cautioned against visiting minecore.ltd or engaging with any prompts to connect wallets, as recovery of drained assets is typically irreversible. Continuous monitoring of related infrastructure is recommended due to the likelihood of domain rotation or IP reassignment by the threat actor.