casubattle[.]com

This domain, casubattle.com, operates as a crypto drainer phishing site designed to mimic legitimate cryptocurrency gaming platforms. Analysis indicates the site employs deceptive interfaces to harvest wallet credentials, subsequently draining funds from connected digital asset storage. The infrastructure targets users seeking gaming-related crypto rewards, exploiting trust in blockchain-based entertainment to facilitate unauthorized transactions and asset theft. Evidence confirms the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 104.21.73.17 and is flagged by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and has been identified in one AlienVault OTX threat intelligence pulse. The detection metrics, combined with the recent creation date, suggest a deliberately short-lived campaign optimized for rapid deployment and evasion. Users who visited casubattle.com should immediately disconnect any connected wallets and revoke access to all suspicious dApps via their wallet settings. It is recommended to transfer remaining assets to a new, secure wallet and monitor transaction histories for unauthorized activity. Affected individuals should also scan their devices for malware, as phishing sites often deploy additional payloads. If credentials were entered, consider all exposed accounts compromised and update passwords using a hardware security key or multi-factor authentication method. Report the incident to relevant blockchain security teams for further investigation and potential fund recovery assistance.