evmpool[.]co

This domain, evmpool.co, operates as a crypto wallet drainer designed to siphon digital assets from victims interacting with fraudulent decentralized wallet interfaces. Analysis indicates the site mimics legitimate cryptocurrency pooling services, tricking users into connecting their wallets to malicious smart contracts. Once connected, the drainer automatically executes unauthorized transactions, transferring tokens to attacker-controlled addresses without user consent. The threat specifically targets users of Ethereum Virtual Machine (EVM)-compatible wallets, exploiting their familiarity with staking or liquidity pooling services to lower suspicion. Infrastructure analysis reveals the domain was registered on September 17, 2025, through Eranet International Limited, a registrar frequently associated with high-risk domains. At the time of assessment, evmpool.co resolved to the IP address 104.21.83.117 and was flagged by 7 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appears on one security blocklist, and its Gridinsoft trust score of 0/100 further corroborates its malicious nature. The page title 'Nur einen Moment…' suggests the use of a Cloudflare or similar proxy service to obfuscate the backend infrastructure, a common tactic in phishing campaigns to delay takedowns. Users who visited evmpool.co should immediately disconnect any wallets connected to the site and revoke all associated smart contract approvals using a blockchain explorer or dedicated revocation tool. It is critical to audit all recent transactions for unauthorized activity and transfer remaining assets to a new, secure wallet. If credentials or private keys were entered, assume full compromise and cease using the affected wallet. Monitor connected devices for malware, as crypto drainers are often paired with infostealers. Report the domain to relevant security teams to aid in broader mitigation efforts.