zh-bitpiewallet[.]com

This domain, zh-bitpiewallet.com, operates as a high-risk crypto drainer phishing site designed to deceive users into connecting their cryptocurrency wallets. The site mimics a legitimate multi-chain wallet interface, specifically targeting users managing Bitcoin, Ethereum, Tron, and USDT assets. Once a victim connects their wallet, the embedded malicious script automatically siphons funds to attacker-controlled addresses without further user interaction, making this a particularly aggressive form of financial fraud. Analysis indicates the domain was registered on October 18, 2024, through West263 International Limited, a registrar frequently associated with fraudulent infrastructure. The site resolved to the IP address 172.104.88.95 and used a Let's Encrypt SSL certificate to create a false sense of legitimacy. Detection metrics reveal widespread recognition of its malicious nature: 18 out of 95 security vendors on VirusTotal flagged the domain, while three major security blocklists and four AlienVault OTX threat intelligence pulses have documented its activity. MetaMask and other wallet security systems have explicitly blocked access to prevent user exposure. Users who visited zh-bitpiewallet.com or connected a wallet to the site should immediately revoke all active wallet connections and transfer remaining assets to a new, secure wallet. It is critical to monitor transaction history for unauthorized transfers and report any suspicious activity to relevant blockchain explorers or fraud reporting platforms. Given the domain's recent creation and high detection rate, affected individuals should assume their wallet credentials may have been compromised and avoid reusing passwords or seed phrases across other services.