event-purinta[.]com

This domain is flagged as an active crypto drainer phishing endpoint targeting cryptocurrency wallet users through brand impersonation of Purinta. Analysis indicates the site is designed to execute unauthorized transactions by tricking victims into connecting their wallets, a tactic consistent with crypto-draining malware distribution. The elevated risk level is supported by multiple technical indicators and security vendor detections. Infrastructure analysis reveals the domain event-purinta.com was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolves to IP address 172.67.204.147 and employs Cloudflare services alongside HTTP/3 protocol, likely to obfuscate malicious activity. Security vendor assessments show 5 out of 95 detection engines on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on four security blocklists and is actively blocked by wallet security tools, including MetaMask, PhishDestroy, SEAL, and ScamSniffer. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing sites. Mitigation requires immediate action from both end users and network defenders. Cryptocurrency wallet users should avoid interacting with the domain and revoke any connected wallet permissions associated with it. Network administrators are advised to implement DNS-based blocking for 172.67.204.147 and event-purinta.com at the firewall or proxy level. Security teams should monitor for outbound connections to the domain and investigate any prior interactions, particularly those involving wallet connection requests. Given the domain's recent registration and active blocking by security tools, heightened vigilance is warranted for related phishing campaigns impersonating cryptocurrency platforms.