cashapps[.]us

This domain, cashapps.us, is actively engaged in crypto drainer phishing operations targeting users of the Cash App platform. Analysis indicates the site is designed to trick victims into connecting cryptocurrency wallets, enabling attackers to siphon funds through malicious smart contracts or direct wallet interactions. The threat is particularly severe for users who may mistake the domain for the legitimate Cash App service, given its deceptive naming convention and branding elements. Infrastructure analysis reveals the domain was registered on March 29, 2026, through Spaceship, Inc., a registrar commonly associated with high-risk domains. It resolves to the IP address 44.233.250.75 and employs a Let's Encrypt SSL certificate, which, while providing basic encryption, does not validate the site's legitimacy. The domain appears on three security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, including MetaMask and SEAL, which specialize in detecting crypto-related threats. The creation date, combined with the use of a short-lived SSL certificate, suggests the domain may be part of a larger, ephemeral phishing campaign. Users who have visited cashapps.us or interacted with its content should immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts. Wallet addresses or transaction hashes associated with the domain should be treated as compromised and reported to relevant blockchain explorers or security platforms. If cryptocurrency was transferred, victims should contact their wallet provider or exchange to initiate recovery procedures, though success may be limited. Additionally, affected users should scan their devices for malware, as crypto drainer sites often deploy secondary payloads. Monitoring for unauthorized transactions and enabling multi-factor authentication on all financial accounts is strongly recommended to mitigate further risk.