chipextras[.]com

This domain poses a specific threat as a crypto drainer, which is designed to deceive users into revealing their cryptocurrency wallet credentials or other sensitive information. The domain impersonates Chipotle, a well-known restaurant chain, to lure unsuspecting visitors with offers of discounts or rewards, thereby increasing the likelihood of user engagement and subsequent compromise.

Infrastructure analysis reveals that chipextras.com is registered through Fewmoretaps OU d/b/a Trustname.com and resolves to the IP address 185.158.133.1. The domain was created on April 28, 2026, and is currently active. According to VirusTotal, 14 out of 95 security vendors flag this domain as malicious. Additionally, the domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100. AlienVault OTX has also identified the domain in one threat intelligence pulse, further corroborating its malicious nature.

If users have visited chipextras.com, they are advised to immediately change any passwords or credentials that may have been entered on the site. It is recommended to check cryptocurrency wallets and other financial accounts for any unauthorized activity. Users should also run comprehensive scans on their devices to ensure no malware has been installed. Reporting the incident to the relevant security authorities and informing Chipotle of the impersonation can help mitigate the risk and protect others from falling victim to this threat.