allcryptowallets[.]at

This domain, allcryptowallets.at, operates as a crypto drainer, specifically designed to impersonate a legitimate non-custodial cryptocurrency wallet aggregator under the guise of 'AllCryptoWallets.org.' The site employs malicious JavaScript to siphon funds from connected wallets by tricking users into authorizing transactions through deceptive interfaces. Analysis of the domain reveals it leverages a drainer kit, likely distributed through underground forums, to automate the theft of cryptocurrency assets without user consent. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CSL Computer Service Langenbach GmbH, an Austrian registrar. It resolves to the IP address 80.66.89.171 and is currently flagged by 2 out of 95 security vendors on VirusTotal. The domain appears on three security blocklists and has been explicitly blocked by MetaMask, SEAL, and PhishDestroy. Technologies detected on the site include Node.js, Vue.js, Nuxt.js, and Nginx, which are consistent with modern web applications but do not preclude malicious intent. The Gridinsoft trust score for this domain is 0/100, indicating a high-risk classification. As of the latest assessment, allcryptowallets.at has been taken offline, reducing immediate exposure to users. However, the domain's infrastructure and associated drainer kit may still pose a residual risk if redeployed under a different name or IP address. Users who interacted with the domain are advised to revoke any wallet authorizations granted during the period of activity and monitor their transaction history for unauthorized transfers. Organizations should update blocklists to include the domain and IP address to prevent future access attempts.