itn-teaprotocol[.]live

This domain, itn-teaprotocol.live, is confirmed to operate as a crypto wallet drainer targeting users through phishing tactics. Analysis indicates the site is designed to mimic legitimate cryptocurrency protocols, tricking victims into connecting their wallets to malicious smart contracts. Once connected, the drainer automatically siphons funds from the victim's wallet to attacker-controlled addresses, often resulting in complete asset loss. The threat primarily targets users of decentralized finance (DeFi) platforms, leveraging social engineering to exploit trust in seemingly authentic interfaces. Infrastructure analysis reveals the domain was registered on June 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.169.63 and is currently flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on two security blocklists, including MetaMask and SEAL, which have classified it as a high-risk phishing site. The SSL certificate issued by Google Trust Services does not mitigate the threat, as phishing domains commonly use valid certificates to appear legitimate. Users who have interacted with itn-teaprotocol.live should immediately revoke any connected wallet permissions via their wallet's settings or a blockchain explorer. All connected sessions should be terminated, and the wallet should be scanned for unauthorized transactions. If funds were transferred, victims should report the incident to their wallet provider and relevant blockchain analytics platforms for potential tracing. Additionally, users should monitor their wallets for suspicious activity and consider migrating to a new wallet if compromise is confirmed. Proactive measures, such as verifying domain authenticity and avoiding unsolicited connection requests, are critical to mitigating similar threats.