aa4est[.]daorel[.]ch

PhishDestroy identifies aa4est.daorel.ch as a live cryptocurrency drainer domain hosting a generic cryptocurrency wallet drainer kit. The domain leverages a recently registered subdomain under daorel.ch to host the drainer payload, which is actively serving malicious JavaScript designed to siphon funds from victims’ wallets during cryptocurrency transaction signing. No specific brand is spoofed in this campaign, indicating a broad opportunistic targeting strategy across multiple wallet providers and DeFi interfaces.

This domain was flagged during active threat hunting with the following technical indicators: SSL certificate issued by Let’s Encrypt, VirusTotal detection rate at 7/95 as of last scan, registered under Namecheap Inc., resolving to IP address 185.149.120.183 located in Switzerland (CH), and currently not listed on Google Safe Browsing (GSB). The domain was created on an unknown date but became active within the last 30 days based on passive DNS correlation. Blocklist aggregator checks show 0 current detections across public threat intelligence feeds, indicating a newly deployed and largely undetected campaign.

As of today, the campaign remains active with the domain serving live content. Immediate actions include isolating the IP 185.149.120.183 and blocking all subdomains under daorel.ch at network perimeter. Users should avoid visiting the URL and report any transactions involving this domain to their wallet provider. The current risk is assessed as HIGH due to the absence of signature-based detection and the domain’s use of a trusted SSL certificate. Full forensic indicators and IOCs are available in the associated threat report under seed d37dff.