credil[.]club

This domain is flagged as a high-risk crypto wallet drainer phishing site targeting users through credential harvesting and unauthorized transaction signing. Analysis indicates the infrastructure was designed to mimic legitimate wallet interfaces, tricking victims into approving malicious smart contracts that siphon digital assets from connected wallets. Infrastructure analysis reveals the domain credil.club was registered on April 15, 2026, through Dynadot Inc, a registrar frequently associated with phishing campaigns. It resolves to IP address 37.77.150.150, hosted in Russia under LLC Baxet, with no SSL certificate present. Security vendors on VirusTotal detected the domain at 21/95, while it appears on three distinct security blocklists. The domain is currently blocked by multiple threat intelligence feeds and has been taken offline following detection. Mitigation requires immediate revocation of any wallet permissions granted to credil.club or associated addresses. Users should verify all transaction requests through official wallet interfaces and avoid interacting with domains lacking SSL certificates. Network-level blocking of the IP 37.77.150.150 is recommended for organizations. Wallet providers should monitor for connections originating from this domain and alert users who may have interacted with it prior to takedown.