cnbvn[.]carrd[.]co

This domain, cnbvn.carrd.co, is identified as a crypto-focused phishing site targeting users with a wallet drainer mechanism. The page title 'BTT' suggests an attempt to impersonate or exploit associations with BitTorrent Token (BTT) or similar cryptocurrency projects, though no direct brand impersonation is confirmed. Analysis indicates the site likely functioned as a credential harvester or malicious smart contract interaction prompt, designed to drain funds from victims' crypto wallets upon connection or transaction approval. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc. and resolves to the IP address 172.64.147.222, geolocated within the United States under AS13335 (Cloudflare, Inc.). VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious infrastructure. No creation date is available in the provided data, and the domain is not listed in Google Safe Browsing at the time of this report. The domain has since been taken offline, mitigating immediate risk to end users. It was blocked by at least two security blocklists, including PhishDestroy and PhishingDB, indicating proactive detection by the threat intelligence community. Despite its offline status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations and individuals are advised to monitor wallet addresses for unauthorized transactions, revoke permissions for suspicious smart contracts, and implement browser-based or DNS-level blocking for known phishing indicators. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains or subdomains.