wickstripe[.]shop

PhishDestroy identifies wickstripe.shop as an active crypto drainer phishing domain leveraging brand impersonation tactics. This domain mimics legitimate cryptocurrency service interfaces to trick users into connecting wallets and approving malicious token transfers. No specific drainer kit fingerprint has been confirmed, but the site exhibits classic injection behaviors typical of pre-built phishing toolkits targeting Web3 users. The domain's recent registration and minimal infrastructure suggest a high-velocity campaign designed for rapid deployment and takedown evasion.

Technical indicators reveal concerning metrics: VirusTotal currently shows 1/95 detections despite active phishing activity, indicating either zero-day infrastructure or delayed detection coverage. The domain resolves to IP 34.111.179.208 via Let's Encrypt SSL (valid certificate), registered through an anonymized registrar with creation date occurring within the last 90 days. Google Safe Browsing (GSB) status remains unflagged, while third-party blocklists contain zero current entries. These metrics suggest this domain is actively evading conventional security layers.

Current status remains under investigation as security teams analyze payload delivery mechanisms. Immediate response includes adding wickstripe.shop to enterprise blocklists and browser extension blacklists. Remaining risk is assessed as HIGH due to the domain's active status, crypto-specific targeting, and unflagged status across major security platforms. Users are advised to avoid interactions and report any wallet connection attempts to their security teams immediately.