jherryr[.]top

This domain is flagged as a high-risk crypto wallet drainer specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The threat involves malicious scripts that siphon digital assets from victims' wallets upon interaction, typically through deceptive transaction prompts or fake security alerts. The severity of this threat is amplified by its active status and targeted nature, posing immediate financial risks to users of the impersonated service.

Analysis indicates that jherryr.top was registered on May 13, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains. The domain resolves to the IP address 45.192.219.214, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, a network with a history of facilitating fraudulent activities. Security vendors on VirusTotal flag this domain at a rate of 9/95, while it appears on three distinct security blocklists, including those maintained by specialized cryptocurrency threat intelligence platforms. The SSL certificate, issued by Let's Encrypt (R13), provides minimal assurance, as it is commonly exploited by threat actors to lend superficial legitimacy to malicious sites.

Mitigation against this crypto drainer requires immediate action from both end-users and network defenders. Users are advised to verify wallet addresses using trusted sources before executing transactions and to employ hardware wallets or isolated browser profiles for cryptocurrency activities. Network-level protections should include blocking the domain and its resolving IP (45.192.219.214) at firewalls and DNS resolvers. Organizations should monitor for connections to the associated autonomous system (AS138995) and alert on any attempts to access the domain. Given the financial nature of this threat, affected users must revoke active wallet sessions and transfer assets to new, secure wallets if compromise is suspected.