piteas[.]app

This domain, piteas.app, is identified as a crypto drainer phishing site designed to compromise digital asset wallets by tricking users into authorizing malicious transactions. The threat specifically targets cryptocurrency holders through deceptive interfaces that mimic legitimate wallet or exchange platforms, enabling unauthorized fund transfers to attacker-controlled addresses. Infrastructure analysis reveals the domain was configured to exploit common trust signals, such as the use of a Let's Encrypt SSL certificate, to appear legitimate while executing wallet-draining scripts upon user interaction. Technical indicators confirm elevated risk levels associated with this domain. It resolves to the IP address 23.254.144.232 and was registered through Tucows Domains Inc on October 01, 2025. Detection metrics include flags from 3 out of 95 security vendors on VirusTotal, alongside listings on three independent security blocklists. The domain has been referenced in two threat intelligence pulses, further corroborating its malicious intent. Its page title, "hwsrv-1328699.hostwindsdns.com — Host welcome page for," suggests misconfigured or obfuscated hosting infrastructure, a common tactic in phishing operations to evade detection. Users who visited piteas.app or interacted with its content should immediately revoke any active wallet authorizations associated with the site. It is critical to audit connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet address. Browser data, including cookies and cached files, should be cleared to eliminate residual session tokens. Additionally, affected users are advised to monitor their accounts for signs of compromise and report the domain to relevant security communities to aid in broader threat mitigation efforts.