dapp[.]atv[.]ceo

This domain, dapp.atv.ceo, has been confirmed as a crypto drainer phishing site designed to impersonate the ATV brand. Analysis of the page title and infrastructure suggests the site was engineered to deceive users into connecting wallets, likely executing unauthorized transactions to drain cryptocurrency assets. No specific drainer kit signatures were identified in public threat feeds, but the use of Inertia.js and Nginx aligns with common phishing toolchains observed in similar campaigns. Technical indicators reveal the domain was registered on February 21, 2026, through Go Daddy, LLC, and resolved to the IP address 3.27.194.179. Detection metrics include a VirusTotal score of 3/95, indicating limited but targeted identification by security vendors. The domain holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. It appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing infrastructure. As of the latest assessment, dapp.atv.ceo has been taken offline, reducing immediate exposure to end users. However, the domain's recent creation date and the use of a reputable registrar suggest the threat actors may attempt to repurpose or re-deploy the infrastructure. Remaining risks include potential domain resale, re-registration under a different TLD, or migration of the phishing kit to a new host. Users who interacted with the site are advised to revoke wallet permissions, monitor transaction histories for unauthorized activity, and verify future interactions with the legitimate ATV platform through official channels.