onlinemonitoring-crypto-obmennik[.]buzz

This domain, onlinemonitoring-crypto-obmennik.buzz, operates as a crypto drainer phishing site targeting users of cryptocurrency exchange services. The infrastructure is designed to mimic legitimate exchange monitoring platforms, tricking victims into connecting wallets or entering private keys. Once compromised, funds are automatically siphoned to attacker-controlled addresses without further user interaction, a hallmark of crypto drainer operations. The page title, "OnlineMonitoring-Crypto-Obmennik.buzz — мониторинг обменника онлайн," reinforces the false legitimacy by using Russian-language branding commonly associated with Eastern European exchange services. Analysis indicates the domain was registered on May 21, 2026, through Porkbun, and resolves to the IP address 185.173.37.79. Security vendors have flagged the domain on VirusTotal, with 10 out of 95 engines detecting malicious activity. The domain appears on three security blocklists and is referenced in five AlienVault OTX threat intelligence pulses. Additional protective measures include blocks by MetaMask, PhishDestroy, and SEAL, further corroborating its malicious intent. The SSL certificate, issued by Let’s Encrypt, does not mitigate the threat, as phishing sites frequently use valid certificates to appear trustworthy. Users who visited onlinemonitoring-crypto-obmennik.buzz should immediately revoke any wallet connections made through the site and transfer remaining assets to a new, secure wallet. Monitor transaction histories for unauthorized transfers, particularly those involving small test transactions followed by larger withdrawals. If private keys or seed phrases were entered, assume full compromise and treat the wallet as permanently exposed. Report the incident to relevant exchange platforms and consider filing a report with local cybercrime authorities. Future interactions with similar domains should be avoided unless verified through official channels.