ettytousdt[.]webflow[.]io

This domain, ettytousdt.webflow.io, operates as a crypto drainer phishing site designed to steal digital wallet credentials and drain cryptocurrency assets. Victims are typically lured through fraudulent investment offers, fake airdrops, or impersonation of legitimate crypto platforms. Once a user connects their wallet to the site, malicious scripts automatically execute unauthorized transactions, transferring funds to attacker-controlled addresses without consent. The threat primarily targets users of decentralized finance (DeFi) platforms and non-custodial wallets, exploiting the irreversible nature of blockchain transactions. Analysis indicates this domain is highly malicious, with 8 out of 95 security vendors on VirusTotal flagging it as phishing or fraudulent. The site was hosted through Webflow, a legitimate website builder, which is frequently abused by threat actors to rapidly deploy phishing infrastructure. Infrastructure analysis reveals the domain resolved to IP address 172.64.151.8 and used an SSL certificate issued by Google Trust Services, a common tactic to appear legitimate. Google Safe Browsing classified the site under SOCIAL_ENGINEERING, and it appears on three security blocklists, including MetaMask and PhishDestroy. The domain has since been taken offline, but similar variants may still be active. If a user visited ettytousdt.webflow.io and connected a wallet, immediate action is required. First, revoke all active wallet connections to the site via the wallet’s connected apps or dApp permissions settings. Next, transfer remaining assets to a new, secure wallet with a fresh seed phrase. Monitor transaction history for unauthorized transfers and report any stolen funds to the relevant blockchain explorer and law enforcement. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. To prevent future incidents, verify domain authenticity before interacting with crypto-related sites and use hardware wallets for high-value assets.