vetnpro[.]cloud

This domain is flagged as a high-risk crypto drainer infrastructure specifically designed to impersonate the BITHOVEN cryptocurrency exchange platform. Analysis indicates the threat actor's objective is the unauthorized siphoning of digital assets from connected wallets through deceptive transaction prompts and malicious smart contract interactions, a technique commonly referred to as wallet draining. Infrastructure analysis reveals the domain vetnpro.cloud was registered on November 10, 2025, through GoDaddy and currently resolves to IP address 27.124.32.147, hosted by CTG Server Limited (AS152194) in Hong Kong. The Let's Encrypt SSL certificate (YR2) provides minimal encryption while maintaining low operational costs. Security telemetry shows 4 out of 95 vendors on VirusTotal detect the domain as malicious, and it appears on three distinct security blocklists. The page title explicitly displays BITHOVEN, confirming the impersonation target, and the domain remains actively serving malicious content as of the latest verification. Organizations and individuals should implement immediate mitigation measures against this crypto drainer threat. Block the domain vetnpro.cloud and its resolving IP 27.124.32.147 at firewall and DNS levels. Deploy wallet protection extensions that detect and block malicious contract interactions, and educate users to verify domain authenticity before connecting wallets. Monitor network traffic for connections to the identified IP range and review transaction logs for unauthorized smart contract executions. Given the active status of this infrastructure, assume any interaction with the domain will result in immediate asset loss.