backup-wallet[.]info

This domain, backup-wallet.info, is confirmed to operate as a crypto drainer, a specialized form of phishing infrastructure designed to siphon cryptocurrency assets from victim wallets. The site employs deceptive wallet backup prompts and malicious JavaScript payloads to trigger unauthorized transactions, redirecting funds to attacker-controlled addresses. The threat is particularly insidious due to its ability to bypass user awareness, executing transactions silently once wallet permissions are granted. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with detections spanning phishing, malware, and fraud categories. Registered through Sav.com, LLC on May 27, 2026, the domain exhibits an anomalous creation date, suggesting potential domain spoofing or backdating to evade detection. It currently resolves to the IP address 34.76.205.124 and appears on three security blocklists, including high-reputation threat intelligence feeds. The absence of an SSL certificate further undermines its legitimacy, as modern phishing infrastructure typically enforces HTTPS to appear credible. Users who have interacted with backup-wallet.info should immediately revoke any wallet permissions granted to the site, as these may persist even after the initial interaction. All connected wallets should be audited for unauthorized transactions, with particular attention to outgoing transfers to unfamiliar addresses. If funds were transferred, victims should report the incident to their wallet provider and relevant blockchain analytics platforms to track asset movement. Additionally, any credentials or recovery phrases entered on the site must be considered compromised, necessitating the creation of new wallets and the revocation of access to all linked services. Proactive monitoring of associated accounts is recommended for at least 90 days to detect delayed exploitation attempts.