thevidmate[.]net

PhishDestroy assesses thevidmate.net as an ACTIVE crypto drainer posing as the VidMate app, carrying an under-investigation risk rating. The actor behind this domain is weaponizing the VidMate brand to trick users into downloading a malicious installer that drains crypto wallets upon launch. Thevidmate.net was created on February 13, 2025, and resolves to IPv4 188.114.97.3. It currently shows 0/95 VirusTotal detections and remains unlisted on any known blocklists. The domain is registered through Porkbun LLC using a Let’s Encrypt SSL certificate, which may help it evade early detection by blending in as a legitimate HTTPS endpoint. Despite its recent registration and zero VT flags, the domain’s rapid propagation across social media channels suggests a coordinated campaign targeting users searching for the VidMate Android application. Technical indicators point to a high-risk deployment. The absence of detections does not equate to safety, especially when paired with a fresh domain age (under 30 days), a benign registrar reputation, and a high-traffic IP range historically associated with dynamic hosting environments. The use of a free certificate authority further lowers the barrier to deployment, enabling the threat actor to iterate quickly and maintain operational security. Mitigation requires immediate network and endpoint blocking. Organizations should block egress and ingress traffic to 188.114.97.3 and the domain itself via DNS filtering. Users must avoid downloading VidMate from third-party sites and verify installation packages only from the official website or trusted app stores. Security teams should monitor for lateral movement or anomalous wallet activity post-access to the domain. Given the zero-day nature of this campaign, behavioral analysis and sandbox detonation are recommended for any related installers.