drainer[.]bot

This domain, drainer.bot, is identified as a credential theft and crypto asset drainer infrastructure. Analysis indicates the site presents a fraudulent authentication interface titled 'Authentication | Sign In,' designed to harvest login credentials and private keys from cryptocurrency wallet users. No direct brand impersonation has been confirmed, but the domain operates as a generic credential harvester with embedded wallet-draining functionality, commonly deployed in phishing campaigns targeting decentralized finance (DeFi) and wallet users. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., and resolves to the IP address 64.29.17.1, hosted on Amazon.com, Inc. (AS16509) infrastructure located in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. At the time of assessment, the domain is flagged by 10 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was previously blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) detection was reported in the latest available data. The domain is currently offline, likely taken down following detection by security providers or hosting intervention. However, the risk of re-emergence remains elevated due to the domain's recent registration and association with known drainer kit infrastructure. Users who interacted with the site are advised to revoke any connected wallet sessions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists with the domain, IP, and SSL fingerprint (R12) to prevent future exposure. Continuous monitoring of newly registered domains with similar naming patterns (e.g., 'drainer.*') is recommended to detect potential successor campaigns.