coreumrlusd[.]com

This domain, coreumrlusd.com, is actively engaged in a crypto drainer phishing operation targeting users of the Coreum blockchain platform through a fraudulent "Liquidity Rewards Program." The page title, "Coreum × RLUSD — Liquidity Rewards Program," explicitly impersonates the Coreum brand, a known blockchain project, to deceive victims into connecting wallets and authorizing malicious transactions. Infrastructure analysis reveals no direct evidence of a known drainer kit, but the domain’s structure and content align with typical crypto drainer phishing tactics, including the use of urgency-driven reward claims to exploit user trust. Technical indicators confirm elevated risk. The domain is flagged by 9 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It resolves to IP address 172.67.207.158 and was registered on May 28, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain appears on three security blocklists, including MetaMask, PhishDestroy, and SEAL. SSL certification is provided by Let’s Encrypt, and the site employs Cloudflare for hosting, including HTTP/3 and HSTS, which may obscure further analysis of backend infrastructure. No Google Safe Browsing (GSB) detections were reported at the time of analysis. The domain remains active and poses a continued threat to users interacting with Coreum or RLUSD-related services. Response actions by security providers have included blocklisting, but the infrastructure remains accessible. Users are advised to verify all blockchain interactions through official Coreum channels and avoid connecting wallets to unsolicited reward programs. Organizations should monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those leveraging Cloudflare and Let’s Encrypt for SSL, as these are recurring indicators in crypto drainer campaigns.