myetherwallet[.]top

This domain, myetherwallet.top, is identified as a high-risk crypto drainer phishing site designed to compromise cryptocurrency wallets by tricking users into connecting their wallets to malicious smart contracts. Analysis indicates the domain impersonates a legitimate cryptocurrency wallet service, likely leveraging social engineering tactics to drain funds from unsuspecting victims. No specific drainer kit has been confirmed, but the infrastructure aligns with known crypto drainer campaigns targeting Ethereum and ERC-20 token holders. Infrastructure analysis reveals the domain was registered on February 21, 2026, through a widely used registrar, and resolves to the IP address 47.254.25.190, hosted on Alibaba (US) Technology Co., Ltd. (AS45102). The domain is flagged by 11 out of 95 security vendors on VirusTotal, with detections spanning phishing, malware, and fraud categories. It appears on three security blocklists, including PhishDestroy, SEAL, and PhishingDB, and is currently blocked by multiple threat intelligence feeds. The SSL certificate, issued by Let's Encrypt (R12), is a common tactic to lend false legitimacy to malicious domains. As of the latest assessment, myetherwallet.top is offline, displaying a 502 Bad Gateway error, suggesting either takedown efforts or temporary suspension by the threat actor. However, the domain remains a residual risk due to its recent registration and persistent presence on security blocklists. Users who interacted with this domain are advised to revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations should update their threat intelligence feeds to include this domain and its associated indicators of compromise (IOCs) to prevent future exposure.