h5[.]status[.]qpon

This domain, h5.status.qpon, is actively distributing a crypto drainer payload designed to siphon digital assets from connected wallets. Victims who interact with the site risk irreversible loss of cryptocurrency, as the malicious scripts embedded in the page automatically execute unauthorized transactions once a wallet is linked. The site mimics legitimate promotional or status-check pages, using social engineering tactics to trick users into authorizing access to their funds. Analysis indicates the domain was registered on March 25, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Security vendors on VirusTotal have flagged h5.status.qpon as malicious, with 12 out of 95 detections confirming its involvement in crypto-related fraud. Infrastructure analysis reveals the site resolves to the IP address 43.103.40.129, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.) in Hong Kong. The domain appears on three security blocklists, including PhishDestroy and SEAL, and uses a Let's Encrypt SSL certificate to feign legitimacy. If you visited h5.status.qpon or interacted with its content, immediately disconnect any connected wallets and revoke all active session permissions. Scan your device for malware using updated security tools to detect potential secondary infections. Monitor wallet transactions for unauthorized activity and consider migrating assets to a new wallet if suspicious behavior is observed. Report the domain to relevant threat intelligence platforms to aid in broader mitigation efforts.