emaarpass[.]com

PhishDestroy identifies emaarpass.com as an active crypto-draining phishing domain engineered to mimic Emaar Properties, a Dubai-headquartered real-estate brand. The site is currently live and distributing malicious JavaScript payloads designed to siphon cryptocurrency from victim wallets upon wallet connection. Security telemetry confirms the drainer kit is actively harvesting seed phrases and private keys, then exfiltrating funds to attacker-controlled addresses monitored across multiple blockchains. The campaign specifically targets users searching for Emaar digital services or NFT giveaways, leveraging brand trust to lower victim suspicion.

This domain was flagged by ScamSniffer and surfaces on one security blocklist. VirusTotal records a detection ratio of 1/95 security vendors, indicating limited but present coverage. The domain resolves to IPv4 address 104.21.2.183 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The registration date is March 25, 2026, and the site presents a valid Let’s Encrypt TLS certificate to appear legitimate. Google Safe Browsing has not yet blacklisted the domain, giving it an elevated risk posture among users relying on Safe Browsing protections.

As of today, emaarpass.com remains active and unresolved, with minimal vendor detection and no takedown in progress. Users should block the domain at the network perimeter and block the IP 104.21.2.183 immediately. Remaining risk is elevated due to the low vendor detection rate, fresh registration, and absence from major blocklists. Recommend immediate browser and wallet extension scans, revocation of any connected wallet permissions, and reporting to PhishDestroy via the seed 835e04 for ongoing tracking.