vozvrat-info[.]com

vozvrat-info.com is an active crypto drainer posing as a refund or cashback service to trick cryptocurrency users into connecting their wallets. Once a victim visits, the site prompts them to connect a wallet under the guise of processing a refund. Behind the scenes, malicious smart contracts are silently approved, granting unauthorized access to crypto funds that are drained within minutes. This is not a simple phishing page — it actively interacts with wallet software and executes blockchain transactions without clear consent. Users who connect their wallets risk losing all assets stored in connected accounts.

PhishDestroy flagged this domain after identifying zero detections on VirusTotal (2/95 engines as of data collection). The domain vozvrat-info.com was registered on March 12, 2026 through NAMECHEAP INC and resolves to IP address 187.124.176.202. It uses a legitimate-looking SSL certificate issued by Let's Encrypt, which may help it bypass browser warnings and appear trustworthy to non-technical users. Notably, the site claims to offer financial refunds or returns, likely targeting users expecting money back from purchases, exchanges, or services.

If you visited vozvrat-info.com or connected your wallet, immediately revoke any unauthorized smart contract approvals using tools like revoke.cash or Etherscan’s approval checker. Disconnect the wallet from your browser, scan for malware, and consider transferring remaining funds to a new wallet with a different seed phrase. Do not interact further with the site. Report the address and any wallet interactions to local cybercrime units. Always verify URLs, avoid unsolicited refund offers, and never connect wallets to unfamiliar websites.