mockreceipts[.]com

This domain, mockreceipts.com, is under investigation for brand impersonation targeting Binance, a major cryptocurrency exchange. Analysis of the site’s infrastructure and content reveals it operates as a crypto drainer, presenting itself as a "Crypto Wallet Flasher" under the page title "Mock Receipts || Crypto Wallet Flasher." The site likely aims to deceive users into connecting wallets or entering credentials, enabling unauthorized fund transfers. No explicit drainer kit signature has been confirmed, but the combination of branding, page title, and technical setup aligns with known wallet-draining campaigns. Infrastructure analysis provides the following technical indicators: the domain was registered on August 01, 2025, through Ultahost, Inc., and currently resolves to the IP address 198.23.190.194. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Technologies detected include Bootstrap, Slick, jQuery, HSTS, Cloudflare, and HTTP/3, suggesting a professionally configured front-end designed to evade basic detection. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating low initial visibility. The domain appears on two security blocklists, including PhishDestroy and OISD, but has not been flagged by Google Safe Browsing at this time. Current status remains active, with no takedown or sinkholing observed. The domain’s use of Cloudflare may complicate IP-based blocking and attribution efforts. While the risk level is classified as under investigation, the presence of a crypto drainer theme, combined with the absence of detections on major scanning platforms, suggests a targeted or emerging threat. Users are advised to avoid interacting with the domain, verify wallet connections only through official Binance channels, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include mockreceipts.com and its resolving IP, while security teams should prioritize monitoring for related infrastructure or certificate reuse patterns.