mail[.]tabs-financefx[.]com

This domain is flagged as a high-risk crypto drainer phishing site targeting cryptocurrency wallet users. Analysis indicates malicious intent to execute unauthorized transactions, draining digital assets from connected wallets. The threat is classified as a crypto drainer due to its infrastructure and behavioral patterns, which align with known wallet-draining campaigns. Infrastructure analysis reveals the domain mail.tabs-financefx.com was registered on March 22, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It is detected by 12 out of 95 security vendors on VirusTotal and appears on three security blocklists. The domain has been taken offline, but prior activity suggests it was actively used in phishing operations. Detection by multiple trust providers, including MetaMask and PhishDestroy, further corroborates its malicious classification. To mitigate risks associated with crypto drainer threats, users should immediately revoke any wallet connections to this domain and related addresses. Verify transaction requests independently through official platforms, and employ hardware wallets or multi-signature solutions for high-value assets. Security teams should block the domain and IP at the network level, monitor for residual connections, and educate users on recognizing phishing attempts targeting cryptocurrency wallets. Proactive monitoring of wallet permissions and transaction histories is recommended to detect unauthorized activity.