polkadotwallet[.]fun

This domain, polkadotwallet.fun, has been identified as a crypto drainer phishing site targeting cryptocurrency wallet users. Crypto drainers are malicious scripts designed to siphon digital assets from victims' wallets upon interaction, typically through deceptive wallet connection prompts or fake transaction approvals. The elevated risk level assigned to this domain reflects its active exploitation in financial theft campaigns, with infrastructure analysis confirming its use in credential harvesting and unauthorized fund transfers. Infrastructure analysis reveals the domain was registered through WEDOS Internet, a.s., on March 06, 2026, and resolves to the IP address 46.28.105.2. Detection metrics indicate limited but targeted flagging, with 2 out of 95 security vendors on VirusTotal identifying the domain as malicious. The domain appears on three security blocklists, including those maintained by browser extensions and threat intelligence feeds. Additional indicators include a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate issued by DigiCert Inc does not mitigate the threat, as phishing domains frequently employ valid certificates to appear legitimate. Mitigation measures for this threat type include immediate blocking of the domain and its associated IP address across network security controls. Users who may have interacted with the site should revoke any active wallet connections and transfer remaining assets to a new, secure wallet. Organizations should update endpoint detection rules to identify and block crypto drainer scripts, particularly those impersonating legitimate wallet services. Security teams are advised to monitor for unauthorized transaction patterns and educate users on verifying domain authenticity before connecting wallets to any web-based service.