dcashop[.]vip

The domain dcashop.vip is identified as a crypto drainer scam specifically designed to impersonate CRMEB, a known e-commerce framework. The site is currently offline, but prior analysis confirms its malicious intent to siphon cryptocurrency from unsuspecting users. This assessment is based on concrete technical indicators and threat intelligence. Analysis indicates the domain was flagged by 13 of 95 security vendors on VirusTotal, a significant red flag for malicious activity. It was registered on May 02, 2024, through Gname.com Pte. Ltd., and resolves to the IP address 172.67.196.38, which is associated with Cloudflare’s infrastructure. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Additional technical indicators include the use of Stripe for payment processing, HSTS for enforced HTTPS connections, and a Let’s Encrypt SSL certificate, which are often exploited to lend a false sense of legitimacy. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. The domain is currently offline, but its infrastructure and historical activity present a persistent threat. Users who may have interacted with dcashop.vip should immediately revoke any connected wallet permissions, monitor their cryptocurrency transactions for unauthorized activity, and report the domain to their wallet provider or relevant security platforms. Organizations should update their blocklists to include this domain and its associated IP address to prevent future exposure. Given the use of Cloudflare and other legitimate technologies, vigilance is required to distinguish between genuine and malicious sites, particularly those impersonating trusted brands like CRMEB.