cryptoberz[.]com

This domain, cryptoberz.com, is identified as a crypto wallet drainer phishing site targeting users through fraudulent wallet connection prompts. Analysis indicates no direct brand impersonation, but the site employs social engineering tactics to trick victims into authorizing malicious transactions. The infrastructure leverages common web technologies but lacks legitimate service indicators, suggesting a disposable phishing operation. Infrastructure analysis reveals the domain was registered on March 09, 2026, through Hello Internet Corp, a registrar frequently associated with high-risk domains. It resolves to IP address 188.114.96.3 and is flagged by 15 out of 95 security vendors on VirusTotal. Google Safe Browsing classifies it under SOCIAL_ENGINEERING, and it appears on four security blocklists. Technologies detected include Chart.js, jsDelivr, Facebook Pixel, cdnjs, Cloudflare, and HTTP/3, which may obscure backend tracking or malicious payload delivery. The domain is currently offline, having been taken down following detection by multiple security entities, including MetaMask, PhishDestroy, SEAL, and InversionDNS. Despite its offline status, residual risk remains due to potential re-registration or migration to similar domains. Users who interacted with the site are advised to revoke any wallet authorizations, monitor for unauthorized transactions, and verify connected applications. Organizations should update blocklists to include the domain and associated IP to prevent future access attempts.