dotarmedica[.]com[.]co

PhishDestroy identifies dotarmedica.com.co as an active crypto drainer phishing domain designed to steal cryptocurrency from unsuspecting victims. This malicious site impersonates a medical platform to trick users into connecting their crypto wallets, where a drainer script silently siphons funds. The domain employs deceptive tactics such as mimicking legitimate login interfaces and using urgent medical-themed lures to pressure users into making hasty transactions. Technical analysis confirms the presence of obfuscated JavaScript payloads that interact with blockchain networks to authorize unauthorized transfers. This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating a significant but not universal detection rate. Registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 02, 2022, the domain resolves to IP address 162.241.60.183 and holds a valid Let's Encrypt SSL certificate, which may lend it an air of legitimacy. Despite these superficial validations, the site remains categorized as an elevated-risk threat due to its confirmed malicious functionality. Users who have visited dotarmedica.com.co should immediately disconnect any connected crypto wallets, revoke any unauthorized permissions granted to the site, and scan their devices for malware. PhishDestroy recommends avoiding this domain entirely and verifying any similar sites using its real-time threat database. If funds were stolen, report the incident to relevant blockchain explorers and local cybercrime units while documenting all transaction hashes and wallet interactions.