pragmaspin[.]net

PhishDestroy identifies pragmaspin.net as an active crypto drainer phishing domain posing an elevated risk to users. This domain is engineered to deceive victims into connecting cryptocurrency wallets, triggering unauthorized transactions that drain funds under the guise of legitimate services. The threat is not generic phishing but specifically targets crypto wallet connectivity, leveraging social engineering to exploit user trust in fraudulent services. Given the domain’s active status and the nature of the attack vector, organizations and individuals must treat this as a high-priority threat requiring immediate mitigation.

This domain resolves to IP address 104.21.42.99 and operates with a valid SSL certificate issued by Let’s Encrypt, which may contribute to user trust and hinder detection. VirusTotal analysis shows only 2 out of 95 security vendors currently flag pragmaspin.net, indicating low detection coverage despite active malicious activity. The domain was registered through Fewmoretaps OU, operating under the trade name Trustname.com, and was created on April 8, 2026, suggesting a very recently established infrastructure. While no additional blocklists or reputation scores were provided in the available intelligence, the combination of low detection rates, new domain registration, and the specific crypto drainer threat profile elevates the risk profile significantly.

To mitigate exposure to pragmaspin.net, organizations should immediately implement network-level and endpoint controls to block access to both the domain and its resolved IP address (104.21.42.99). DNS filtering solutions should be updated to include this domain, and endpoint detection and response (EDR) tools should be configured to alert on any connection attempts to 104.21.42.99 or pragmaspin.net. Users should be warned against clicking links or downloading files from this domain, especially in the context of cryptocurrency transactions. Security awareness training should emphasize the risks of connecting wallets to untrusted websites. Finally, organizations are encouraged to share this threat intelligence with peers to enhance collective defense against emerging crypto drainer campaigns.