bobfix[.]netlify[.]app

This domain, bobfix.netlify.app, is actively facilitating a crypto drainer scheme under the guise of the "MainNet Project." Analysis indicates it is designed to siphon cryptocurrency assets from victims by mimicking legitimate blockchain infrastructure. The domain remains operational as of the latest verification, posing a high-risk threat to users interacting with decentralized finance (DeFi) platforms. Infrastructure analysis reveals the domain is flagged by 5 of 95 security vendors on VirusTotal, with detection signatures identifying it as malicious. It is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by DigiCert Inc, specifically a DigiCert Global G2 TLS RSA SHA256 2020 CA1, which is commonly used for both legitimate and malicious domains. The domain appears on one security blocklist, as documented by PhishDestroy, and its page title explicitly references "MainNet Project," a term associated with blockchain networks. Current status confirms the domain remains active, with no takedown or mitigation efforts observed. Organizations and individuals are advised to block the domain and its resolving IP at the network level. End-users should avoid interacting with any content hosted on bobfix.netlify.app, particularly links or prompts related to cryptocurrency transactions. Security teams are recommended to monitor for additional domains leveraging similar naming conventions or infrastructure patterns, as this may indicate a broader campaign targeting DeFi users. Indicators of compromise (IOCs) should be shared with relevant threat intelligence platforms to aid in broader detection efforts.