enriqueonsol[.]vip

This domain, enriqueonsol.vip, is identified as a fake crypto wallet drainer designed to compromise cryptocurrency holdings by tricking users into connecting their wallets to malicious smart contracts. The page title, $Enrique, suggests an attempt to impersonate a legitimate crypto service or promotion, likely leveraging social engineering tactics such as fake airdrops, giveaways, or investment opportunities to lure victims. Once a user connects their wallet, the domain executes unauthorized transactions, draining funds without consent. The threat specifically targets users of decentralized finance (DeFi) platforms and non-custodial wallets, where private keys and seed phrases are not required for transaction approval, making this a high-impact attack vector for financial theft. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent activity. It appears on at least one security blocklist and has a trust score of 1/100 from independent assessment tools, with another source assigning a 0/100 trust rating. The domain was registered on March 26, 2026, through NameCheap, Inc., and resolves to the IP address 64.29.17.1. Infrastructure analysis indicates the use of Vercel for hosting, alongside HTTP Strict Transport Security (HSTS) enforcement and a Let's Encrypt SSL certificate, which are often exploited to create a false sense of legitimacy. The creation date in the future (2026) is anomalous and suggests either a typo or an attempt to evade detection by appearing as a newly registered domain. Users who visited enriqueonsol.vip or interacted with its content should immediately disconnect any connected wallets from the site and revoke all active smart contract approvals using a blockchain explorer or wallet management tool. It is critical to check wallet transaction history for unauthorized transfers and report any suspicious activity to the relevant blockchain network. If wallet credentials, seed phrases, or private keys were entered on the site, the wallet should be considered compromised, and all funds should be transferred to a new, secure wallet. Users should also monitor their devices for malware or unauthorized access, as phishing sites may deploy additional payloads. Finally, report the domain to security teams at cryptocurrency platforms, wallet providers, and threat intelligence communities to prevent further exploitation.