boostkite.us: Active Crypto Drainer Phishing Site Impersonating

The domain boostkite.us has been confirmed as an active crypto drainer phishing site designed to harvest wallet credentials and execute unauthorized transactions. Analysis of the page title, 'Confirm Your Action,' indicates the site mimics authentication portals commonly used in blockchain and cryptocurrency services. No explicit brand impersonation is evident, though the structure aligns with known drainer kits targeting decentralized finance (DeFi) and wallet recovery workflows. The site employs deceptive prompts to trick users into granting wallet permissions, enabling attackers to siphon assets upon interaction. Technical indicators reveal multiple high-risk attributes. The domain is registered through NAMECHEAP INC and was created on May 19, 2026, suggesting a recently deployed infrastructure. It resolves to the IP address 172.67.165.151, hosted behind Cloudflare, Inc. in California, a common tactic to obfuscate origin servers. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while three distinct security blocklists—including PhishDestroy, MetaMask, and SEAL—have listed it for phishing activity. The SSL certificate is issued by Let's Encrypt (serial number E8), providing a veneer of legitimacy while failing to mitigate the underlying threat. As of the latest assessment, boostkite.us remains active and unremediated, posing a sustained risk to users. The domain's presence on multiple blocklists and detection by security vendors confirm its malicious intent, though the Cloudflare proxy complicates takedown efforts. Users are advised to avoid interaction with the domain and any associated links. Wallet providers and security platforms should prioritize blocking access to 172.67.165.151 and the domain itself. Organizations should update detection rules to include the domain's unique seed (0c913e) and monitor for related infrastructure, particularly those leveraging Let's Encrypt certificates and Cloudflare hosting.