daomaker[.]at

This domain, daomaker.at, is identified as a high-risk phishing site specializing in cryptocurrency credential theft. Analysis indicates the infrastructure was designed to mimic legitimate crypto platforms, likely deploying a wallet drainer kit to siphon digital assets upon user authentication. The page title, www.daomaker.at, suggests direct impersonation of the DAO Maker ecosystem, a known target for phishing campaigns due to its active user base in decentralized finance. Infrastructure analysis reveals the domain was registered through Hosting Concepts B.V. (Registrar.eu) and resolves to the IP address 191.44.114.185. Detection metrics show 21 out of 95 security vendors flagged the domain on VirusTotal, while three independent blocklists have listed it for malicious activity. The SSL certificate, issued by Let’s Encrypt (R13), provides minimal encryption but does not validate legitimacy. No creation date is publicly available, though the domain’s rapid takedown suggests recent registration. Google Safe Browsing (GSB) status is not explicitly documented, but the domain’s presence on multiple blocklists aligns with typical phishing indicators. The domain is currently offline, likely following abuse reports or registrar intervention. However, residual risk remains due to potential re-registration under a new registrar or IP. Users who interacted with the site should revoke any connected wallet permissions and monitor accounts for unauthorized transactions. Organizations are advised to update blocklists with the IP 191.44.114.185 and domain to prevent future exposure. Continuous monitoring of related infrastructure is recommended, as threat actors frequently rotate domains to evade detection.