governance-flyingtulip[.]com

This domain is under investigation for operating as a crypto wallet drainer, a threat type designed to siphon digital assets from unsuspecting users by exploiting transaction signing prompts. Analysis indicates the domain exhibits characteristics consistent with automated asset theft, including the use of deceptive smart contract interactions or fake token approvals to trigger unauthorized transfers. The risk level remains classified as under_investigation pending further behavioral analysis and victim reports. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.169.193, which hosts multiple other suspicious endpoints. The domain’s SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. Despite a VirusTotal detection score of 0/95, the domain appears on four security blocklists, including entries from MetaMask, PhishDestroy, SEAL, and ScamSniffer. AlienVault OTX has also flagged the domain in a single threat intelligence pulse, suggesting early-stage detection by automated systems. Mitigation requires heightened vigilance from users interacting with decentralized finance (DeFi) platforms or crypto wallets. Transactions involving this domain should be immediately revoked via wallet interfaces that support token approval management. Network-level blocking of the domain and its resolving IP (172.67.169.193) is recommended for enterprise and institutional environments. Users should verify transaction details in wallet prompts, particularly those requesting unlimited token allowances or interactions with unknown smart contracts. Wallet software and browser extensions that detect malicious contract interactions should be updated to their latest versions to leverage real-time threat intelligence.