usdwon[.]eu

This domain, usdwon.eu, is confirmed to operate as a crypto drainer phishing infrastructure designed to siphon cryptocurrency assets from victims. Analysis indicates the site employs deceptive wallet connection prompts, tricking users into authorizing malicious transactions that transfer funds to attacker-controlled addresses. The domain’s infrastructure leverages Cloudflare hosting, a common tactic to obscure origin servers and evade takedowns, while the page title 'Um momento…' suggests the use of a loading screen to mask malicious activity during interaction. Evidence supporting this assessment includes detection by 9 out of 95 security vendors on VirusTotal, with the domain appearing on 2 distinct security blocklists. Infrastructure analysis reveals registration through Dynadot LLC, a registrar frequently abused for phishing campaigns, and resolution to the IP address 172.67.132.29, part of Cloudflare’s network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), further aligns with patterns observed in transient phishing domains that rotate certificates to avoid detection. The domain’s current offline status does not eliminate risk, as such infrastructure is often reactivated under new domains. Users who visited usdwon.eu or interacted with its content should immediately revoke any connected wallet authorizations, particularly those granting transaction permissions. Audit all cryptocurrency transactions for unauthorized transfers and monitor linked accounts for signs of compromise. If funds were transferred, report the incident to relevant blockchain analysis services and local cybercrime authorities. Given the domain’s use of Cloudflare, victims should also check for cached versions of the site in web archives to gather additional indicators of compromise for forensic analysis.