gemwallet-crossmark-rlusd[.]info

This domain, gemwallet-crossmark-rlusd.info, operates as a crypto drainer, a type of malicious infrastructure designed to automatically siphon cryptocurrency from connected digital wallets. The site presents itself as a legitimate allocation portal for RLUSD, a Ripple-associated token, using branding elements from GemWallet and Crossmark to deceive users into authorizing transactions. Once connected, the drainer executes unauthorized transfers, often irreversible, leading to direct financial loss for victims. Analysis indicates the domain was registered on May 29, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to conceal origin infrastructure. Detection metrics further confirm its malicious nature: 18 out of 95 security vendors on VirusTotal flag the domain, and it appears on four distinct security blocklists, including PhishDestroy and ScamSniffer. The SSL certificate, issued by Let’s Encrypt, provides no assurance of legitimacy due to the ease of acquisition. If a wallet was connected to this domain, immediate action is required to mitigate damage. Users should revoke all active session approvals via their wallet’s connected sites or dApp permissions interface. Transfer remaining assets to a secure, unrelated wallet address, and monitor transaction history for unauthorized activity. No recovery of drained funds is typically possible, so prevention through verification of official sources and avoidance of unsolicited allocation claims remains critical.