storeb0e9df2409c1[.]blob[.]core[.]windows[.]net

PhishDestroy identifies storeb0e9df2409c1.blob.core.windows.net as an active crypto drainer infrastructure. This Microsoft Azure Blob Storage endpoint mimics legitimate cloud storage to deceive users into connecting crypto wallets and authorizing malicious transactions. The domain leverages Microsoft’s SSL certificate (CN=Microsoft Corporation) to enhance credibility, tricking victims into believing the site is a secure, official Microsoft service. No specific drainer kit fingerprint is publicly disclosed yet, but behavioral analysis suggests a generic crypto-draining script targeting wallet connections.

This domain exhibits multiple suspicious technical indicators. VirusTotal shows 6/95 detections as of the latest scan, indicating it remains under the radar of major antivirus engines. Registered through MarkMonitor, Inc., a common registrar for malicious domains, the site resolves to IP 135.130.64.96. Notably, the domain was created on August 10, 1995—an unusually early registration date for a recently active phishing domain, suggesting potential domain squatting or historical compromise. Google Safe Browsing (GSB) and other threat intelligence feeds have not yet flagged or blocklisted this domain, leaving users exposed.

The domain is currently active, with a status marked as 'under_investigation' by PhishDestroy. Response actions include ongoing behavioral and code analysis to identify the drainer kit and its propagation methods. While no active takedown or blocklisting has occurred yet, the low VT detection rate and unflagged GSB status pose a significant risk to uninformed users. Users are advised to avoid interactions, verify via PhishDestroy, and report any wallet connections to this domain immediately. Remaining risk is assessed as moderate to high due to the domain’s age, credible SSL certificate, and untargeted nature.