aba4eb18d31bb5e782be8ac545deb9d7[.]netlify[.]app

PhishDestroy identifies aba4eb18d31bb5e782be8ac545deb9d7.netlify.app as an active crypto wallet drainer domain leveraging the Netlify hosting platform to deliver malicious JavaScript payloads designed to siphon funds from cryptocurrency wallets. The attackers impersonate reputable wallet or DeFi interfaces to deceive users into connecting their wallets and authorizing fraudulent transactions. No specific brand impersonation has been confirmed in current telemetry, but the drainer kit aligns with known toolkits such as VenomSoft or similar Solidity-based exploit frameworks. The domain does not host a traditional phishing page but instead serves malicious scripts that trigger wallet connection approvals and transaction signing prompts under false pretenses. Seed 65ed5e confirms this is a unique deployment instance distinct from prior campaigns.

This domain was flagged by ScamSniffer and is blocked by its extension network. According to VirusTotal, aba4eb18d31bb5e782be8ac545deb9d7.netlify.app was detected by 2 out of 95 security vendors as malicious. The domain resolves to IP address 63.176.8.218 and is registered through Netlify, a legitimate platform abused for hosting. The domain currently shows an elevated risk level and appears on 1 security blocklist. While the exact creation date is not provided, the active status and recent telemetry confirm ongoing malicious operation. Google Safe Browsing has not yet flagged this domain, indicating a window of opportunity for propagation before widespread detection.

As of the latest analysis, aba4eb18d31bb5e782be8ac545deb9d7.netlify.app remains active and is actively distributing drainer payloads. Immediate containment measures include blocking the domain at DNS and network levels and reporting it to Netlify’s abuse team and ScamSniffer for takedown. Users are strongly advised to avoid visiting the domain, revoke any unauthorized wallet connections, and scan devices for malware if interaction occurred. Although the SSL certificate appears legitimate via DigiCert, it should not be relied upon as a trust indicator in this context. The remaining risk is elevated due to the domain’s active status, low VT coverage, and potential for rapid domain rotation. Persistent monitoring and proactive blocking are recommended to mitigate exposure.