extrawallet[.]app

PhishDestroy has flagged www.extrawallet.app as a live crypto drainer domain under active analysis for fraudulent wallet transactions. This site masquerades as a legitimate cryptocurrency wallet service, luring users into connecting their wallets so that malicious scripts can drain funds without explicit confirmation. The infrastructure is hosted on IP 76.76.21.61 and secured by a Let’s Encrypt SSL certificate, giving it a veneer of legitimacy while concealing the hostile code. Blocklist and sandbox verdicts remain pending despite clear behavioral indicators—users should treat every interaction as potentially malicious. Domain telemetry confirms this is a newly observed threat: VirusTotal currently shows zero detections out of 95 scanners, meaning security vendors have not yet added signatures to generic detection engines. The domain resolves to IP 76.76.21.61 and is served over HTTPS via Let’s Encrypt certificate authority, which can mislead visitors into assuming safe browsing. While the registrar and creation date are still under further reconnaissance, preservation of this site’s low VT score suggests rapid deployment designed to evade static analysis. The absence of historical blocklist entries indicates it is actively being developed and tested against mainstream defenses. If you have already visited www.extrawallet.app, immediately revoke all wallet connections via your wallet interface, disconnect any linked dApps, and move remaining assets to a newly generated cold wallet. Do not interact with prompts or sign any messages—even seemingly benign ones—from this domain. Report the URL to PhishDestroy’s threat feed using the seed identifier 52bf8e so that additional network indicators can be correlated. Stay vigilant for wallet transaction alerts and enable multi-factor authentication on all exchange accounts to mitigate potential losses.