web-apptoolextensiondapp[.]com

The domain web-apptoolextensiondapp.com is currently active and has been identified as hosting a crypto drainer scam infrastructure. Analysis indicates this domain is designed to deceive users into connecting cryptocurrency wallets under false pretenses, enabling the unauthorized transfer of digital assets to attacker-controlled addresses.

Infrastructure analysis reveals that this domain resolves to IP address 216.198.79.65 and was registered through NameSilo, LLC on June 13, 2026. VirusTotal scanning has returned zero detections from its 95 integrated detection engines, indicating a lack of immediate signature-based identification. This absence of detection suggests the threat actor is operating with tools and techniques that evade current detection heuristics, likely utilizing obfuscated JavaScript payloads commonly seen in drainer toolkits. The domain’s recent creation further aligns with the operational profile of fast-flux or disposable infrastructure used in phishing campaigns.

Given the domain’s active status and the observed infrastructure, the risk of financial loss to users remains high. Immediate defensive actions include the blocking of the domain at DNS and network levels and flagging the associated IP address for proactive network monitoring. Users should be advised to refrain from interacting with any URLs associated with this domain, particularly those requesting cryptocurrency wallet connections or transactions. Security teams are recommended to scan historical network logs for connections to 216.198.79.65 and to inspect internal endpoints for signs of compromise related to crypto wallet interactions.