gousoroil[.]lat

This domain, gousoroil.lat, is identified as a crypto wallet drainer phishing site designed to steal digital assets from unsuspecting users. The site mimics legitimate cryptocurrency wallet interfaces to trick visitors into entering sensitive credentials or approving malicious transactions, which directly transfer funds to attacker-controlled addresses. Analysis indicates this threat specifically targets users of popular wallet services, exploiting trust in well-known brands to facilitate unauthorized access and asset theft. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered on February 21, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing campaigns. It resolves to the IP address 172.67.218.189 and has been flagged by 4 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists and is referenced in one AlienVault OTX threat intelligence pulse, further corroborating its malicious intent. The Gridinsoft trust score of 1 out of 100 underscores the high-risk classification of this infrastructure. Users who visited gousoroil.lat or interacted with its content should take immediate action to mitigate potential losses. First, disconnect any active wallet sessions and revoke permissions for unknown or suspicious smart contracts using a trusted blockchain explorer. Next, transfer remaining assets to a new, secure wallet address and monitor transaction histories for unauthorized activity. It is also recommended to scan local devices for malware, as phishing sites may deploy additional payloads to compromise systems. Finally, report the domain to relevant security communities and wallet providers to aid in broader threat mitigation efforts.