lowgamb[.]com

The domain lowgamb.com has been identified as a high-risk crypto drainer phishing site, specifically designed to compromise cryptocurrency wallets by tricking users into authorizing malicious transactions. Analysis indicates the domain is currently offline, though it remains a documented threat in recent phishing campaigns targeting decentralized finance (DeFi) users. No direct brand impersonation has been confirmed, but the infrastructure aligns with known wallet-draining schemes observed in prior incidents. Infrastructure analysis reveals the domain was registered on May 24, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 172.67.201.130, which has been linked to other malicious activities in security telemetry. The domain appears on three distinct security blocklists and has been flagged by 15 of 95 security vendors on VirusTotal, with detection labels including generic_phishing, wallet_drainer, and malicious_url. Additional intelligence sources confirm the domain was proactively blocked by multiple threat intelligence platforms, further validating its malicious classification. Current status indicates lowgamb.com is no longer resolving, though historical data and detection metrics suggest it may re-emerge under altered infrastructure or related domains. Organizations and users are advised to maintain blocklist entries for this domain and monitor for re-registration or DNS changes. Cryptocurrency wallet providers should integrate detection rules for this domain and its associated IP to prevent transaction authorization requests from compromised interfaces. End users are urged to verify wallet addresses independently and avoid interacting with unsolicited links, particularly those promising token airdrops or liquidity mining opportunities.