scratcher[.]lol

This domain, scratcher.lol, is identified as a generic phishing threat designed to function as a crypto drainer, likely impersonating or mimicking Scratch-related projects to deceive users into connecting wallets. Analysis indicates no direct brand impersonation, but the domain name and page title ('Scratcher') suggest an attempt to exploit familiarity with the Scratch platform, potentially targeting younger or less experienced users in the crypto space. No specific drainer kit signatures have been confirmed, though the infrastructure aligns with common phishing toolsets used for credential harvesting and wallet compromise. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 188.114.96.3 and was registered on May 20, 2026, through OwnRegistrar, Inc., a registrar frequently associated with malicious domains. Detection metrics show 9 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists and is actively blocked by wallet protection and anti-phishing tools. Technologies detected include Unpkg, Cloudflare Browser Insights, and Cloudflare, with HTTP/3 support, indicating the use of modern, evasive hosting and content delivery methods. As of the latest assessment, scratcher.lol remains active and poses an elevated risk to users. No takedown or sinkholing actions have been observed, and the domain continues to resolve. Users are advised to avoid interaction, particularly wallet connection prompts or credential submission. Network-level blocking is recommended, and security teams should monitor for related domains using similar naming conventions or infrastructure patterns. The combination of recent registration, low trust scores, and active blocklisting underscores the need for heightened vigilance.