piabetgunceladresi[.]icu

This domain, piabetgunceladresi.icu, is flagged as an active credential theft operation targeting cryptocurrency users. Analysis indicates the site mimics legitimate wallet or exchange platforms to trick visitors into entering private keys, seed phrases, or login credentials. Once obtained, these details enable attackers to drain funds from victims' digital wallets without authorization. The threat primarily affects users searching for updated or alternative access points to crypto services, particularly those using mobile or less secure browsing environments. Infrastructure analysis reveals the domain was registered on July 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. As of the latest scan, the domain resolves to the IP address 188.114.97.3 and has not been flagged by any of the 95 security engines on VirusTotal, indicating it may still evade automated detection systems. The absence of detections suggests the campaign is either new or employs evasion techniques to bypass signature-based scanning. Users who have visited piabetgunceladresi.icu or entered sensitive information on the site should immediately take corrective action. Disconnect any connected wallets from the internet and transfer remaining funds to a new, secure wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the domain to relevant security platforms to aid in broader detection efforts. Avoid clicking on any links associated with this domain, and verify the authenticity of crypto-related sites through official channels before entering credentials.