driftsafe[.]com

PhishDestroy identifies driftsafe.com as an active crypto drainer phishing domain currently under investigation. The domain is designed to mimic legitimate cryptocurrency or brand-related services, tricking users into connecting wallets or entering credentials under false pretenses. At this stage, the threat is categorized as generic phishing with an elevated risk profile pending deeper forensic analysis. Security teams should treat interactions with this domain as potentially malicious until further intelligence is gathered.

This domain was flagged by 4 of 95 VirusTotal vendors as of the latest scan, indicating minimal detection coverage despite its active status. The SSL certificate is issued by Let’s Encrypt, a common but often abused provider in phishing campaigns. The domain was registered with Namecheap Inc., and resolves to IP address 185.141.63.204. It was created on February 21, 2024, placing it among recently registered domains frequently leveraged in opportunistic attacks. As of the most recent data, driftsafe.com appears on 1 known blocklist and maintains low trust scores across multiple reputation engines, reinforcing its suspicious profile.

Despite low detection rates, the domain is actively serving malicious content aimed at draining cryptocurrency wallets under the guise of legitimate services. Users who have interacted with this domain should immediately revoke any connected wallet permissions and scan for unauthorized transactions. Organizations are advised to block traffic to driftsafe.com at the firewall and DNS level. Validate any future alerts involving this domain against updated threat intelligence feeds. Continuous monitoring and user awareness training are critical to prevent further compromise. This advisory will be updated as new indicators or detection signatures emerge.