spinharta41[.]com

PhishDestroy identifies spinharta41.com as an active crypto drainer domain impersonating the WalletConnect protocol. The site is engineered to trick users into signing malicious transactions that silently drain cryptocurrency wallets. Technical analysis indicates the use of a custom drainer kit hosted on the domain, designed to intercept wallet signatures and redirect funds to attacker-controlled addresses. Campaigns leveraging this domain are likely distributed via social engineering messages and spoofed support channels, capitalizing on users’ trust in the WalletConnect brand to lower suspicion.

Domain details and forensic indicators reveal the following: spinharta41.com resolves to IP 99.84.152.79, was created on August 29, 2024, and is registered through NameSilo, LLC. The domain currently has 0 detections out of 95 VirusTotal engines as of the latest scan, indicating it remains undetected by most AV and security tools. The SSL certificate is issued by Amazon, adding superficial legitimacy. No blocklist entries are recorded in PhishDestroy or public threat feeds at this time, placing the domain in a high-risk discovery window.

The campaign status is active and under active monitoring by PhishDestroy. Users are advised to avoid visiting spinharta41.com and to verify any WalletConnect connection prompts using PhishDestroy’s verification tool. The remaining risk is elevated due to the domain’s recency, absence of detection, and use of a trusted SSL provider. Immediate blocking of the domain and IP at network and endpoint levels is recommended. PhishDestroy continues to track this domain and will update status as new intelligence emerges.