keyverse[.]com[.]tr[.]orhandurna[.]com[.]tr

This domain, orhandurna.com.tr, is under investigation for operating as a crypto drainer under the guise of the Keyverse brand. Analysis of the page title, Keyverse | Anasayfa, suggests an attempt to impersonate a legitimate cryptocurrency platform, likely targeting Turkish-speaking users. The infrastructure appears designed to facilitate unauthorized transactions, a hallmark of crypto drainer kits, though no specific kit has been conclusively identified at this stage. Infrastructure analysis reveals several technical indicators of concern. The domain resolves to IP address 185.205.19.130 and currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it yet. However, it appears on three security blocklists, including high-confidence sources. The domain was registered on April 30, 2026, an anomalous future date that may indicate registry manipulation or an attempt to evade detection. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy. Gridinsoft assigns a trust score of 0/100, further corroborating the suspicious nature of this infrastructure. The domain has been taken offline, likely in response to security community alerts and blocklist inclusions. While this mitigates immediate risk, the infrastructure may resurface under a different domain or IP. Users who interacted with this site should assume credential or wallet compromise and take immediate action: revoke smart contract approvals, transfer assets to a new wallet, and monitor for unauthorized transactions. The anomalous registration date and rapid blocklist adoption suggest organized malicious activity, warranting continued vigilance for related domains or IPs.