drakehost[.]com

PhishDestroy identifies drakehost.com as an active crypto drainer phishing domain targeting cryptocurrency users through deceptive wallet connection interfaces. No specific brand or drainer kit attribution was observed during initial analysis, though the domain mimics legitimate hosting services to establish false credibility. The infrastructure appears designed to intercept wallet credentials or initiate unauthorized transactions upon user interaction. Security researchers should monitor this domain for evolving tactics, including impersonation of popular NFT marketplaces or DeFi platforms.

Technical indicators for drakehost.com reveal a low detection rate with only 2 out of 95 VirusTotal security vendors flagging the domain as malicious as of the latest scan. The domain is registered through Namecheap Inc., with an IP address associated under Cloudflare’s infrastructure (AS13335). The domain was created on 2023-10-15, and while no Google Safe Browsing (GSB) classification was found, the domain appears on 3 blocklists including PhishTank and OpenPhish. The SSL certificate, issued by Let’s Encrypt, adds a superficial layer of legitimacy despite the domain’s malicious intent.

This domain remains active and poses an elevated risk to cryptocurrency users engaging with unvetted websites. Immediate response actions include blocking the domain at the network perimeter and updating firewall rules to restrict access. Users are advised to avoid interacting with drakehost.com and verify the authenticity of any wallet connection prompts via official channels. While the low VirusTotal score suggests limited widespread detection, the domain’s active status and multi-blocklist presence indicate a credible threat requiring heightened vigilance. Remaining risk is elevated due to the potential for rapid campaign expansion or kit modifications.