anitrascafe[.]org

PhishDestroy identifies anitrascafe.org as a high-risk cryptocurrency drainer impersonating a café website. This domain employs a drainer kit to siphon digital assets from unsuspecting users by mimicking legitimate payment interfaces. The fraudulent site targets crypto holders by masquerading as a point-of-sale portal for café services, tricking visitors into connecting wallets and authorizing malicious transactions. The campaign shows clear intent to exploit blockchain interactions, making it a critical threat to cryptocurrency users. This domain resolves to IP 216.55.149.9 and uses a Sectigo Limited SSL certificate to appear legitimate. Registered on September 2, 2020 through TUCOWS.COM, CO., anitrascafe.org has been active for over three years, providing cover for sustained fraudulent operations. VirusTotal analysis confirms detection by 20 out of 95 security vendors. Google Safe Browsing flags the domain under SOCIAL_ENGINEERING, while it appears on three prominent blocklists including OpenPhish and PhishingArmy. The combination of long domain age with recent flagging indicates a mature but still active threat actor leveraging hosted infrastructure for credential harvesting and fund theft. As of the latest assessment, anitrascafe.org remains active and is actively blocked by major threat intelligence platforms. Despite corrective actions from OpenPhish, PhishingArmy, and InversionDNS, the site continues to pose significant risk due to its cryptocurrency drainer functionality and persistent availability. Users are strongly advised to avoid interacting with this domain entirely. PhishDestroy continues to monitor this threat; however, the domain’s long registration period and partial vendor detection suggest ongoing evolution of its fraudulent infrastructure. Immediate avoidance is the most effective mitigation strategy.