genusne[.]click

This domain, genusne.click, is identified as a high-risk phishing endpoint specializing in cryptocurrency theft through drainer mechanisms. Analysis of the page structure and historical metadata reveals no direct brand impersonation, but the site employs typical drainer kit behaviors designed to siphon digital assets from compromised wallets. The absence of an SSL certificate and the use of a generic page title further indicate low-effort malicious infrastructure, a common trait in short-lived phishing campaigns targeting decentralized finance users. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 05, 2026, through Dynadot, LLC, and resolves to the IP address 37.77.150.150, hosted by a provider in the Russian Federation. At the time of assessment, the domain was flagged by 21 out of 95 security vendors on a major aggregation platform, with detections spanning phishing, fraud, and malicious activity classifications. Additionally, the domain appears on three independent security blocklists, including entries from specialized cryptocurrency threat intelligence feeds. No Google Safe Browsing (GSB) record was available at the time of analysis, suggesting either recent activation or evasion of automated crawlers. The domain has since been taken offline, likely due to enforcement actions by hosting providers or domain registrars. Despite its current inactive status, residual risk persists for users who may have interacted with the site during its operational window. Historical DNS records and cached threat intelligence entries may still trigger security alerts in enterprise environments. Organizations and individuals are advised to monitor wallet addresses associated with this domain, revoke any suspicious permissions, and implement additional authentication layers for cryptocurrency transactions. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.