redline-x[.]info

This domain, redline-x.info, poses as a cryptocurrency betting platform to facilitate credential theft and unauthorized fund transfers. Analysis of the page title, 'Букмекерская компания' (translating to 'Bookmaker Company'), indicates an attempt to mimic legitimate betting services, likely targeting users of crypto wallets and gambling platforms. The infrastructure is designed to harvest login credentials and execute crypto draining attacks, where victims unknowingly authorize transactions that transfer funds to attacker-controlled wallets. Evidence supporting the malicious nature of redline-x.info includes detection by 4 out of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0/100, and a Scamadviser trust score of 20/100. The domain was registered on May 16, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, and currently resolves to the IP address 188.114.97.3. It appears on three security blocklists and has been flagged by multiple threat intelligence sources, including MetaMask and PhishDestroy. The domain's creation date aligns with recent campaigns targeting cryptocurrency users, and its current offline status suggests takedown efforts or evasion tactics. Users who visited redline-x.info should immediately revoke any wallet permissions granted to the site, check for unauthorized transactions, and monitor their accounts for suspicious activity. If credentials were entered, reset passwords for all associated accounts, enable multi-factor authentication, and scan devices for malware. Given the domain's association with crypto draining, affected users should also report the incident to their wallet provider and relevant financial authorities. Infrastructure analysis reveals the domain's short lifespan and low trust scores, reinforcing the need for heightened vigilance when interacting with unfamiliar betting or crypto-related sites.