mint-handle[.]online

Analysis of the domain mint-handle.online indicates it is actively associated with crypto-draining activity, a threat type involving the unauthorized siphoning of cryptocurrency assets from victims. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 172.67.199.173, a Cloudflare-hosted endpoint, and employs HTTP/3 alongside WebAssembly, a combination often leveraged to obfuscate malicious scripts or accelerate client-side attacks. The SSL certificate is issued by Google Trust Services, a common but not inherently trustworthy provider. The page title 'Mint' suggests an attempt to impersonate a financial or cryptocurrency service, though the exact nature of the impersonation—whether targeting a specific brand or a generic financial platform—remains unverified due to the absence of deeper content analysis. The domain has been flagged by 7 of 95 security vendors in aggregated scans and appears in 22 threat intelligence pulses on AlienVault OTX, alongside listings on two security blocklists. Additional detections by PhishDestroy and BLP-Malware further corroborate its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. Defenders should treat this domain as an active crypto-draining threat. The use of Cloudflare and WebAssembly may complicate detection and mitigation, necessitating network-level blocking of the domain and its resolving IP. Given its persistence and the specificity of the threat type, monitoring for related infrastructure—such as newly registered domains with similar naming patterns or shared hosting providers—is recommended. No evidence currently links this domain to broader campaign infrastructure, but its inclusion in multiple threat intelligence feeds suggests it is part of an ongoing malicious operation.