notification-nftxupgrad[.]botmada[.]live

This domain, notification-nftxupgrad.botmada.live, is flagged as a crypto drainer, a threat type designed to siphon cryptocurrency assets from victim wallets. The domain is currently offline, but prior analysis confirms its malicious intent. The page impersonates Netflix, likely to deceive users into connecting wallets or entering sensitive credentials under false pretenses. Infrastructure analysis reveals the domain resolves to IP 158.69.52.169, hosted by OVH Hosting, Inc. in Canada. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain appears on one security blocklist and is flagged by 22 of 95 security vendors on VirusTotal. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for both legitimate and malicious sites. Additional telemetry indicates the domain was blocked by PhishDestroy, further corroborating its malicious classification. Current status confirms the domain is offline, reducing immediate risk to users. However, infrastructure associated with this threat may persist. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. End-users should verify wallet connections and revoke access to any suspicious domains via blockchain explorers. Monitoring for related domains registered through the same registrar or hosted on the same IP range is recommended to preemptively mitigate similar threats.