primary-device-correct[.]com

This domain, primary-device-correct.com, is identified as a high-risk crypto drainer leveraging a deceptive reCAPTCHA verification interface to trick users into authorizing malicious blockchain transactions. The page mimics legitimate security checks but is designed to exploit wallet connections, draining cryptocurrency assets upon interaction. Analysis of the threat infrastructure indicates a targeted attack vector aimed at users of decentralized platforms, where perceived security prompts are used to bypass user caution and execute unauthorized transactions without explicit consent. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to the IP address 91.202.233.241, hosted under Prospero OOO in Turkmenistan, and was registered through OwnRegistrar, Inc. on April 27, 2026. Detection metrics confirm widespread recognition of the threat: 17 out of 95 security vendors on VirusTotal flag the domain, while it appears on three distinct security blocklists. The SSL certificate, issued by Let’s Encrypt (R13), provides minimal assurance, as it is commonly abused in phishing campaigns due to its low-cost, automated issuance process. The domain’s creation date, set in the future, further suggests an attempt to evade temporal reputation-based detection systems. Users who visited primary-device-correct.com or interacted with its reCAPTCHA verification prompt should assume potential compromise of any connected cryptocurrency wallets. Immediate actions include revoking all active wallet authorizations, transferring remaining assets to a new, secure wallet, and conducting a full security audit of the affected device. No further interaction with the domain should occur, and any credentials or recovery phrases entered must be considered exposed. Monitoring for unauthorized transactions across all linked accounts is strongly advised, as the attack may extend beyond the initial drain attempt.