elizaos[.]fun

This domain, elizaos.fun, is flagged as a crypto credential theft operation targeting users of cryptocurrency wallet services. Analysis indicates the site mimics legitimate wallet login interfaces to harvest private keys, seed phrases, or authentication credentials. No explicit drainer kit signatures were identified, but the infrastructure aligns with known credential-harvesting campaigns. The page title 'Home | Eliza' suggests an attempt to impersonate a user-friendly or branded interface, though no direct brand association was confirmed. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 188.114.97.3 and is registered through NameSilo, LLC, with a creation date of May 14, 2026—an anomalous future timestamp likely intended to evade detection or domain reputation checks. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists and is actively blocked by wallet security tools and phishing prevention systems. Technologies detected include HSTS, Cloudflare, and HTTP/3, which are frequently leveraged to obfuscate malicious activity behind legitimate infrastructure. The domain is currently offline, reducing immediate exposure risk. However, residual threats persist due to the domain's registration remaining active and its infrastructure potentially repurposed for future campaigns. Response actions should include continued monitoring for DNS reactivation, IP reassignment, or registrar-level abuse reports. Users who interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and scan for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.