whopaccounts[.]app

PhishDestroy identifies whopaccounts.app as an active crypto drainer, a high-risk phishing threat designed to steal cryptocurrency wallet credentials and drain assets. This domain (registered May 15, 2026) currently shows 1/95 VirusTotal detections and lacks inclusion on major blocklists, making it a stealthy threat. The domain resolves to IP 188.114.97.3 via NICENIC INTERNATIONAL GROUP CO., LIMITED, with a Let's Encrypt SSL certificate, suggesting an attempt to appear legitimate.

This domain was flagged due to its active role in crypto drainer campaigns, specifically targeting users of Whop accounts. Key indicators include the absence of detections (1/95 on VirusTotal), a recently registered domain (May 15, 2026), and a hosting IP tied to a registrar known for minimal oversight. The SSL certificate further masks malicious intent, as threat actors commonly leverage free certificates to evade detection. No prior reports on blocklists or trust score downgrades have been recorded, emphasizing the need for proactive monitoring.

To mitigate risk, users must avoid interacting with whopaccounts.app entirely. If credentials or wallet details were entered, immediately revoke access via the official Whop platform and transfer remaining assets to a new wallet. Report the domain to PhishDestroy for inclusion in blocklists. Always verify URLs via official channels and use hardware wallets or multi-factor authentication to secure crypto holdings. Avoid clicking unverified links in emails or messages claiming to be from Whop.