rivalmods[.]net

rivalmods.net is a recently deployed crypto drainer phishing domain currently active and propagating malicious content. The domain is designed to deceive users into connecting cryptocurrency wallets under false pretenses, enabling unauthorized fund transfers. Threat intelligence confirms this domain is not a generic phishing attempt but a targeted crypto drainer campaign aimed at stealing digital assets. This domain was flagged by 4 of 95 VirusTotal security vendors, indicating limited but confirmed malicious activity. It was registered on December 23, 2025, through CNOBIN INFORMATION TECHNOLOGY LIMITED, resolving to IP address 172.67.173.126. The domain holds an SSL certificate issued by Google Trust Services and appears on 1 security blocklist, reinforcing its elevated risk profile. rivalmods.net should be treated as a high-risk indicator of compromise (IOC). Users must avoid accessing this domain or interacting with any associated content. Security teams are advised to block the domain and IP at the network perimeter. Immediate review of wallet connection logs is recommended for any users who may have visited this domain. Implement DNS filtering and endpoint protection to prevent further exposure.