btcpay416170[.]lndyn[.]com

This domain, btcpay416170.lndyn.com, was identified as a crypto wallet drainer phishing site designed to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, the site executes unauthorized transactions, draining funds from victims' wallets without consent. The infrastructure mimics legitimate cryptocurrency payment gateways, leveraging social engineering tactics to exploit users familiar with decentralized finance platforms. Analysis of the site's frontend technologies, including Vue.js and Clipboard.js, suggests an intent to automate and streamline the theft of wallet credentials and transaction signing prompts. Evidence supporting this assessment includes the domain's registration details and detection metrics. The domain was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently associated with phishing campaigns due to its accessibility and low-cost domain offerings. At the time of analysis, the domain resolved to the IP address 170.75.161.89 and was flagged by 4 out of 95 security vendors on VirusTotal, indicating a moderate but elevated risk profile. Additionally, the domain appeared on one security blocklist, further corroborating its malicious nature. The observed HTTP 429 status code suggests the site may have been subjected to rate-limiting or takedown efforts prior to going offline. Users who visited btcpay416170.lndyn.com or interacted with its content should take immediate remedial actions to mitigate potential risks. First, disconnect any cryptocurrency wallets that were previously linked to the site, and revoke all active smart contract authorizations using a wallet management tool. Monitor transaction histories for unauthorized activity and transfer remaining funds to a new, secure wallet address. If credentials or private keys were entered, consider the compromised wallet as permanently exposed and avoid reusing it. Finally, report the incident to relevant blockchain security teams and local cybersecurity authorities to assist in tracking and disrupting further malicious activity.