multismartwallet[.]live

The domain multismartwallet.live has been identified as a crypto drainer, a specialized threat designed to siphon cryptocurrency assets from compromised wallets. Analysis confirms the domain is currently offline, though it previously hosted infrastructure facilitating unauthorized transactions. The page title, "Swift Chain Server," suggests an attempt to mimic legitimate blockchain services, though no direct brand impersonation has been confirmed. Infrastructure analysis reveals the domain was registered on May 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 104.21.56.170 and was flagged by 11 of 95 security vendors on VirusTotal. The domain appears on three security blocklists, including PhishDestroy and MetaMask, indicating broad detection across threat intelligence platforms. The SSL certificate was issued by Google Trust Services under the identifier WE1, a common certificate authority for both legitimate and malicious domains. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure may resurface under a different domain or IP address. Recommendations include monitoring for similar domains registered through the same registrar, blocking the resolved IP (104.21.56.170) at the network level, and educating users on verifying wallet connections before authorizing transactions. Security teams should review logs for interactions with multismartwallet.live or its associated IP to identify potential compromise.