poaiiswbie[.]hetins[.]biz[.]id

This domain, poaiiswbie.hetins.biz.id, is assessed at an elevated risk level and is specifically identified as a crypto drainer phishing domain. The threat poses a significant risk to users who may inadvertently access the site, potentially leading to the theft of cryptocurrencies and sensitive information.

Analysis indicates that poaiiswbie.hetins.biz.id has been flagged by 16 out of 95 security vendors on VirusTotal, suggesting a moderate consensus on its malicious nature. The domain is registered through PT Registrasi Neva Angkasa and resolves to the IP address 172.67.190.4, which is located in the United States and associated with AS13335 Cloudflare, Inc. The domain was created on August 10, 2025, and it appears on two security blocklists: PhishDestroy and PhishingDB. Despite these warnings, the domain currently has no SSL certificate, which is a common indicator of a lack of legitimate security measures. The current status of the domain is offline, indicating that it may have been taken down or is no longer active.

To mitigate the risks associated with this crypto drainer phishing domain, users are advised to avoid visiting the site and to ensure their browsers and security software are up-to-date. Organizations should implement DNS filtering and web protection solutions to block access to this domain. Additionally, users should be cautious of unsolicited emails or messages that direct them to this domain and should verify the legitimacy of any cryptocurrency-related communications. Regular security audits and user education on phishing tactics are also recommended to prevent potential attacks.