dinolrop[.]com

This domain, dinolrop.com, is identified as a targeted credential theft operation focusing on cryptocurrency wallet users. Analysis indicates the site mimics legitimate wallet interfaces to deceive victims into entering sensitive information such as private keys, seed phrases, or login credentials. Once obtained, these details enable attackers to drain funds from associated wallets, resulting in irreversible financial losses for victims. The threat specifically exploits users of decentralized finance (DeFi) platforms and self-custody wallet services, where recovery phrases are the sole means of account recovery. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.97.3, which has been linked to other phishing campaigns in recent threat intelligence reports. Detection metrics further substantiate the malicious classification: 7 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. Additionally, the domain is referenced in a single AlienVault OTX threat intelligence pulse, indicating its inclusion in active threat tracking systems. Users who visited dinolrop.com or interacted with its content should take immediate remedial action. Any credentials, private keys, or recovery phrases entered on the site must be considered compromised. Affected individuals should transfer remaining assets from exposed wallets to new, secure wallets using a clean device. It is critical to revoke any connected dApp authorizations and monitor transaction histories for unauthorized activity. Devices used to access the domain should undergo a full malware scan to rule out secondary infections. Given the irreversible nature of cryptocurrency transactions, victims are advised to report the incident to relevant blockchain analysis platforms and local cybercrime authorities to aid in tracking and mitigation efforts.