6a433220cb3be96e4624dfd5--tranquil-douhua-203562[.]netlify[.]app

This domain, 6a433220cb3be96e4624dfd5--tranquil-douhua-203562.netlify.app, is flagged as a high-risk crypto drainer phishing site. Analysis indicates the threat specifically targets cryptocurrency wallet credentials, employing social engineering tactics to induce victims into disclosing sensitive authentication details or signing malicious transactions. The presence of a page titled 'Decentralization' suggests an attempt to impersonate legitimate decentralized finance (DeFi) platforms, a common vector for crypto asset theft. Infrastructure analysis reveals the domain is registered through Netlify, a legitimate hosting provider often abused for phishing campaigns due to its free tier and SSL support. The site resolves to IP address 63.176.8.218 and utilizes an SSL certificate issued by DigiCert Inc, which may lend an appearance of legitimacy. Detection metrics include 5 out of 95 security vendors on VirusTotal flagging the domain, while Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING.' The domain appears on three security blocklists and is actively blocked by multiple wallet security providers, further confirming its malicious intent. No legitimate creation date is publicly available, indicating potential use of ephemeral or auto-generated subdomains. Mitigation against this crypto drainer threat requires immediate action from both end users and network administrators. Users should verify all DeFi-related URLs against official project sources and avoid interacting with unsolicited links, particularly those promising rewards or airdrops. Wallet software should be configured to reject untrusted connections, and hardware wallets should be used for transaction signing where possible. Network-level protections include implementing DNS-based blocking for the domain and its resolving IP, as well as monitoring for outbound connections to 63.176.8.218. Security teams are advised to update detection rules to include this domain and its associated indicators of compromise, given its active status and high-risk classification.