treasurypool-purplebitcoin[.]com

This domain, treasurypool-purplebitcoin.com, is actively operating as a crypto drainer scam. Crypto drainers are malicious scripts or websites designed to automatically siphon cryptocurrency from victims' wallets once connected. Unlike traditional phishing, which may only steal login credentials, crypto drainers execute unauthorized transactions in real-time, often leaving victims with empty wallets. The domain mimics legitimate cryptocurrency services, using branding elements like 'treasury' and 'bitcoin' to appear trustworthy, but its sole purpose is financial theft through wallet compromise. Analysis indicates this domain was registered on June 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335), which is commonly used to obfuscate the true origin of malicious sites. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flag this domain, suggesting it may be a newer or less-detected variant. The domain is also blocked by one security blocklist, further confirming its malicious nature. If you visited treasurypool-purplebitcoin.com or connected a cryptocurrency wallet to it, immediate action is required. First, disconnect any active wallet sessions and revoke permissions for the domain using your wallet's connected apps or dApps settings. Next, transfer all remaining funds to a new, secure wallet address that has never been exposed to this domain. Monitor your transaction history for any unauthorized activity and report the incident to your wallet provider or a relevant cybersecurity response team. Avoid interacting with any links or pop-ups from the domain, and consider running a full security scan on any device used to access it to detect potential malware or keyloggers.