renbridge-v1[.]com

This domain, renbridge-v1.com, operates as a crypto drainer phishing site designed to compromise digital wallets by tricking users into authorizing malicious smart contracts. Once connected, the site executes unauthorized transactions, draining cryptocurrency assets from victims' wallets without their consent. The threat primarily targets users of decentralized finance (DeFi) platforms, leveraging social engineering tactics to mimic legitimate bridging services. Analysis indicates the domain was registered on February 21, 2026, and is hosted on infrastructure belonging to AS16509 (Amazon.com, Inc.) at IP address 15.197.240.20. The domain is flagged by 11 out of 95 security vendors on VirusTotal, with detections spanning multiple categories including phishing and fraud. It appears on five independent security blocklists, including those maintained by wallet security providers. The SSL certificate is issued by Go Daddy Secure Certificate Authority - G2, a common choice for both legitimate and malicious domains due to its widespread recognition. Users who interacted with renbridge-v1.com should immediately revoke any connected wallet permissions via their wallet interface or a trusted revoke tool. Monitor transaction histories for unauthorized transfers and report any suspicious activity to the relevant blockchain explorer or wallet provider. If funds were lost, file a report with local cybercrime authorities and provide transaction hashes as evidence. Avoid reusing passwords or seed phrases associated with compromised wallets, and enable multi-factor authentication on all critical accounts.