sym[.]app-beefy[.]sbs

This domain, sym.app-beefy.sbs, is identified as a crypto drainer scam specifically targeting decentralized finance (DeFi) users by impersonating Beefy Finance, a legitimate yield optimizer platform. Analysis indicates the threat actors designed the domain to mimic the authentic Beefy interface, likely to trick victims into connecting wallets and executing malicious smart contracts that drain funds. No specific drainer kit has been attributed yet, but the infrastructure aligns with known crypto phishing campaigns observed in recent months. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 31, 2024, through Dynadot LLC, a registrar frequently abused for phishing operations. As of the latest scan, VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists, though it remains unlisted in Google Safe Browsing (GSB) databases. No associated IP address has been confirmed in public threat feeds, suggesting the operators may be using ephemeral hosting or content delivery networks to evade detection. The domain remains active and operational, with no takedown or sinkholing observed. Response actions by security providers include blocking by PhishDestroy, MetaMask, and SEAL, though gaps in coverage persist due to the domain's recent registration and limited detection. Users are advised to treat any interaction with sym.app-beefy.sbs as malicious, particularly wallet connection prompts or transaction requests. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as wallet addresses or smart contract interactions tied to this campaign.