pippin[.]fun-referal-1jolxind[.]lol

This domain, pippin.fun-referal-1jolxind.lol, poses as a legitimate Phantom crypto wallet service to deceive users into connecting their wallets. The site is designed to function as a crypto drainer, siphoning funds from victims by tricking them into authorizing malicious transactions under the guise of a Christmas distribution event. Phantom users are particularly at risk, as the site mimics the brand’s interface and messaging to appear credible. Analysis indicates the domain was registered on December 31, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with newly created malicious domains. The domain resolves to IP address 172.67.128.202 and is currently flagged by 2 out of 95 security vendors on VirusTotal. Additionally, it appears on two security blocklists, including ScamSniffer and PhishDestroy, and has a Gridinsoft trust score of 0/100. The page title, Pippin Christmas Distribution, further suggests an attempt to exploit seasonal urgency to lure victims. If a user interacted with this domain, immediate action is required. First, revoke any wallet permissions granted to the site via the connected wallet’s settings. Next, transfer remaining funds to a new, secure wallet address not previously exposed to the malicious domain. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain security platforms. Users should also scan their devices for malware, as crypto drainers may deploy additional payloads to maintain persistence or exfiltrate sensitive data.