gro24h-coinpwire[.]com

This domain, gro24h-coinpwire.com, is actively distributing a crypto drainer threat designed to siphon digital assets from users under the guise of a legitimate cryptocurrency payment platform. The site presents itself as a service simplifying crypto transactions for everyday use, but analysis indicates it is engineered to execute unauthorized transfers from connected wallets. The threat specifically targets users who interact with the site by linking their crypto wallets, leading to immediate and irreversible asset depletion without consent or notification. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 26, 2024, through Ultahost, Inc., and currently resolves to the IP address 192.142.10.5. It holds a Gridinsoft trust score of 0/100 and is flagged by 2 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as it is commonly used by both legitimate and malicious sites to encrypt traffic. If a user has visited gro24h-coinpwire.com or connected a wallet to the site, immediate action is required. First, disconnect the wallet from any associated dApps or sites and revoke all active session permissions using a blockchain explorer or wallet management tool. Next, transfer remaining assets to a new, secure wallet address that has never been exposed to the domain. Monitor transaction history for any unauthorized activity and report the incident to the wallet provider and relevant security teams. Users should also scan their devices for malware, as crypto drainers may deploy additional payloads to maintain persistence or exfiltrate credentials.