withdrawal[.]transactionshield[.]info

Security researchers at PhishDestroy have identified withdrawal.transactionshield.info as an active crypto-phishing domain designed to mimic legitimate withdrawal interfaces and harvest user credentials. The domain resolves to IP 104.21.14.198 and is currently leveraging Google Trust Services SSL certificates to appear authentic, which increases the likelihood of user deception. Threat actors are known to rapidly deploy similar decoy portals to target cryptocurrency users during transactional workflows. This domain has been formally flagged by ScamSniffer and appears on a single security blocklist, indicating confirmed malicious activity. VirusTotal analysis shows 3 out of 95 participating security vendors have already marked the domain as malicious, underscoring its elevated risk profile. While the SSL certificate is issued by a reputable authority, the domain’s recent deployment and low detection rate suggest it is part of an emerging campaign rather than a well-established threat. Users who have visited withdrawal.transactionshield.info should immediately cease any ongoing interactions, avoid entering sensitive credentials, and scan their devices for potential compromise. If credentials were entered, rotate passwords immediately, revoke any API keys or withdrawal permissions associated with the account, and monitor for unauthorized transactions. Report the domain to your security team or platform for further action. Given the domain’s active status and SSL-backed appearance, heightened vigilance is strongly advised for anyone interacting with crypto-related web services.