novarmint[.]com

This domain, novarmint.com, is identified as a crypto drainer phishing site designed to illicitly extract cryptocurrency assets from victims' wallets. Analysis indicates the domain operates without impersonating a specific brand, instead deploying generic but highly effective drainer scripts to bypass user authentication and initiate unauthorized transactions. The infrastructure appears to leverage automated kits, common in large-scale crypto theft operations, to maximize exploitation efficiency. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 11, 2026, through NameCheap, Inc., and resolves to the IP address 63.250.38.225. It holds a VirusTotal detection score of 4/95, indicating limited but confirmed malicious activity recognition. The SSL certificate is issued by Sectigo Limited, a common certificate authority often exploited by threat actors to lend false legitimacy. The domain appears on two security blocklists and is actively blocked by PhishDestroy and OISD, further corroborating its malicious intent. As of the latest assessment, novarmint.com has been taken offline, likely due to registrar intervention or hosting provider action. However, the elevated risk persists due to the potential for rapid re-deployment under a new domain or IP address. Users who interacted with this domain are advised to immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Continuous monitoring of newly registered domains with similar patterns is recommended to mitigate recurring threats.