dough-wallet[.]com

The domain dough-wallet.com has been confirmed as a crypto drainer phishing site designed to illicitly siphon cryptocurrency assets from victims. Analysis indicates this infrastructure is currently offline but previously operated as a fraudulent cryptocurrency wallet service, presenting itself as a legitimate platform for secure digital asset management. The threat type is classified as a crypto drainer, a specialized form of phishing that directly targets cryptocurrency holdings by tricking users into connecting their wallets to malicious smart contracts or scripts. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated registration that may indicate an attempt to evade immediate detection or scrutiny. The domain resolves to the IP address 146.70.87.22, hosted under AS9009 (M247 Europe SRL) in the United States, a network segment frequently associated with malicious activity. At the time of assessment, the domain appears on one security blocklist and is flagged by 11 of 95 vendors on VirusTotal, including specific detections for crypto-related fraud. Notably, the site lacks an SSL certificate, further reducing its legitimacy and increasing exposure to interception risks. Current status indicates the domain has been taken offline, though the underlying infrastructure remains a potential threat if reactivated. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address (146.70.87.22) to prevent future access. Given the elevated risk posed by crypto drainers, vigilance is recommended when engaging with cryptocurrency platforms, particularly those lacking verifiable SSL certificates or established reputational history.