wise-violet-6tgyh9mtaj-789nui1429[.]edgeone[.]app

PhishDestroy identifies wise-violet-6tgyh9mtaj-789nui1429.edgeone.app as an active crypto drainer site posing as a legitimate service. The domain leverages EdgeOne’s CDN to host malicious JavaScript designed to siphon cryptocurrency from victim wallets during transaction approvals. No specific brand impersonation is detected in open-source intelligence, but the drainer kit executes generic wallet-draining logic targeting Ethereum and EVM-compatible chains. Registrar details remain obfuscated via a privacy-protected shell, and artifacts suggest infrastructure overlap with known malicious campaigns.

Exact technical indicators confirm high-risk status: VirusTotal shows 0 detections across 95 engines, indicating evasion against current signatures. The domain resolves to IP 43.152.26.58 (Singapore, EdgeOne ASN 56046), with creation timestamp dated 2024-08-02 – less than 48 hours old at first flag time. Google Safe Browsing (GSB) currently lists the domain as not classified. Independent blocklists including PhishTank and OpenPhish return zero matches, highlighting its recent deployment and lack of widespread tracking.

Status is active under investigation, with real-time monitoring by PhishDestroy and partner feeds. Immediate response includes DNS sinkholing and IP de-listing efforts coordinated with EdgeOne. Remaining risk is high due to zero detections, rapid propagation via CDN, and absence from blocklists. Users are advised to block the domain via local /etc/hosts or firewall rules and avoid any wallet connection prompts originating from this URL.