bot-security[.]shop

PhishDestroy identifies bot-security.shop as an active crypto drainer domain designed to steal cryptocurrency via fraudulent Ledger wallet login pages. The domain leverages a generic security-themed name to appear legitimate while hosting convincing phishing content aimed at tricking users into entering their seed phrases or private keys. Security researchers have classified this infrastructure as part of a broader campaign targeting cryptocurrency holders, where victims are lured through fake support links, spoofed advertisements, or redirect chains originating from compromised social media accounts or malicious ads. The domain does not appear to impersonate a specific brand beyond the Ledger wallet ecosystem, suggesting a focus on credential harvesting rather than brand impersonation alone. This domain was flagged with a detection score of 4 out of 95 on VirusTotal (as of the latest scan), indicating limited but noteworthy detection by security vendors. It resolves to IP address 104.21.36.250 and utilizes a legitimate Let's Encrypt SSL certificate to enhance credibility. The domain is registered through a privacy-protected registrar, with creation date details obscured to hinder historical tracking. It is currently blocked by the OISD security blocklist and appears on one additional public blocklist, placing it at the lower end of elevated risk categories. The low VirusTotal score suggests either minimal exposure or obfuscation techniques designed to evade automated detection systems. As of the most recent analysis, bot-security.shop remains active and unresolved. PhishDestroy continues to monitor and block access to this domain across its network. Users are strongly advised to verify any website claiming to be a cryptocurrency service using PhishDestroy's real-time verification tools before entering sensitive information. Despite current blocklist measures, the domain retains an elevated risk due to its active infrastructure and potential for rapid rebranding under new domains. The combination of a low detection score and minimal blocklist presence underscores the need for continuous vigilance and proactive threat intelligence sharing.