xn--rnabet552-g5a[.]com

PhishDestroy identifies xn--rnabet552-g5a.com as an active crypto drainer phishing domain posing as a casino app to steal cryptocurrency. This deceptive site mimics legitimate gaming platforms to trick users into connecting crypto wallets and approving fraudulent token transfers. The domain is likely part of a broader campaign targeting crypto enthusiasts through social media ads or spoofed websites, where attackers replace wallet addresses with their own during transactions.

This domain was flagged with a 2/95 VirusTotal detection score at the time of analysis, indicating it has not yet been widely recognized by security vendors. Registered on April 05, 2026 — unusually recent for malicious infrastructure — it was set up through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.97.3. The use of a legitimate-looking SSL certificate (Let's Encrypt) further disguises its malicious intent, as phishing operators often exploit free certificates to appear trustworthy. Users may encounter this domain via malvertising, social media promotions, or phishing emails mimicking cryptocurrency platforms.

If you visited xn--rnabet552-g5a.com and connected a wallet or entered any credentials, assume compromise. Immediately disconnect your wallet from any dApps or websites, revoke suspicious token approvals using tools like Etherscan’s Token Approval Checker or Revoke.cash, and transfer remaining funds to a clean wallet. Scan your device with reputable antivirus software (e.g., Malwarebytes, Windows Defender) and enable two-factor authentication on all crypto accounts. Report the domain to your wallet provider and consider using a dedicated hardware wallet for storage. Do not approve wallet connections or transactions unless you are 100% certain of the recipient’s legitimacy.