thepicartz[.]com

This domain, thepicartz.com, is identified as a confirmed crypto credential theft operation. Analysis indicates the site employs deceptive interfaces mimicking legitimate cryptocurrency wallet services to harvest login credentials, recovery phrases, and private keys. No specific brand impersonation has been confirmed, but the infrastructure aligns with known wallet-drainer kits targeting MetaMask and other browser-based wallets. The threat actor likely leverages social engineering tactics, such as fake airdrop claims or wallet verification prompts, to trick users into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on August 26, 2025, through HOSTINGER operations, UAB. It is flagged by 11 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on 3 security blocklists and has been referenced in 4 AlienVault OTX threat intelligence pulses. No associated IP address or Google Safe Browsing (GSB) status is currently available, but the domain has been actively blocked by MetaMask, PhishDestroy, and SEAL. The rapid inclusion in multiple blocklists suggests high confidence in its malicious nature. As of the latest assessment, thepicartz.com has been taken offline, likely due to registrar enforcement or hosting provider action. While the domain is no longer resolving, the risk persists for users who may have interacted with it prior to takedown. Historical DNS records or cached versions of the site may still pose a threat. Organizations and individuals are advised to monitor for unauthorized cryptocurrency transactions, revoke permissions for suspicious wallet connections, and update security controls to block related domains. The domain's registration date and rapid flagging indicate a short-lived but high-impact campaign, typical of credential theft operations.