atos-bet[.]com

PhishDestroy has identified atos-bet.com as an active crypto drainer domain designed to impersonate the legitimate AtosBet platform, luring users into connecting their cryptocurrency wallets under false pretenses. This domain was registered on November 15, 2025, through NAMECHEAP INC, and currently resolves to IP address 104.21.15.61. While it utilizes a Google Trust Services SSL certificate to appear legitimate, its recent creation and absence of VirusTotal detections (1/95 engines) indicate a sophisticated, emerging threat that evades standard detection mechanisms. Technical indicators confirm this domain is weaponized to exfiltrate cryptocurrency assets by tricking users into authorizing malicious wallet connections. The domain’s recency and clean VirusTotal reputation suggest it is likely part of a newly launched campaign, exploiting user trust in familiar betting brands. Additionally, its registration through NAMECHEAP INC, a domain registrar frequently exploited by malicious actors due to low barriers to entry, underscores the urgency for heightened scrutiny. Users who have visited atos-bet.com or interacted with its interface should immediately disconnect any connected wallets, revoke any unauthorized permissions via wallet settings, and conduct a full security audit of their digital assets. Disconnecting from this domain and performing a malware scan on devices used for cryptocurrency transactions are critical steps to mitigate potential losses. Report the domain to PhishDestroy for verification and further analysis to prevent others from falling victim to this crypto drainer.