vara[.]yiteni[.]com

This domain, vara.yiteni.com, is flagged as a generic phishing threat with an elevated risk level. Analysis indicates it impersonates a $VAR Rewards Allocation Proposal, likely targeting cryptocurrency users with a fraudulent rewards scheme. The page title, 'Variational — $VAR Rewards Allocation Proposal,' suggests an attempt to deceive victims into believing they are interacting with a legitimate token distribution or governance proposal. No specific drainer kit signatures have been confirmed, but the domain exhibits characteristics consistent with credential harvesting and wallet-drain phishing campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 45.140.205.214, hosted on an Ubuntu server running Nginx. It was registered through Gname.com Pte. Ltd. on May 21, 2013, though recent activity suggests potential compromise or repurposing for malicious use. The domain appears on 4 security blocklists and is blocked by MetaMask, PhishDestroy, SEAL, and ScamSniffer. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100, further corroborating its fraudulent nature. As of the latest assessment, vara.yiteni.com has been taken offline, reducing immediate exposure risk. However, the domain's historical registration and infrastructure persistence pose residual threats. Users who interacted with the site should assume credential or wallet compromise and take immediate remediation steps, including revoking connected dApp permissions, rotating passwords, and monitoring for unauthorized transactions. The elevated risk level persists due to the domain's prior activity and the likelihood of similar infrastructure being reused for future campaigns. Continuous monitoring of associated IPs and registrant details is recommended to preempt potential re-emergence.