fourmem[.]shop

Domain fourmem.shop has been flagged for hosting a crypto drainer kit designed to steal cryptocurrency from unsuspecting users. The site mimics legitimate crypto platforms to trick victims into connecting their wallets, with the malicious payload likely embedded in its frontend or via injected scripts. No specific brand impersonation has been confirmed yet, but the site’s structure resembles common drainer frameworks observed in recent campaigns targeting decentralized finance users.

Technical indicators align with a newly deployed threat actor infrastructure. The domain resolves to IP 104.21.14.19 and utilizes a Let's Encrypt SSL certificate to appear legitimate. VirusTotal currently shows 0 detections out of 95 engines, suggesting this is a fresh domain operating below detection thresholds. The registrar remains unverified in open sources, and no Google Safe Browsing (GSB) blocklisting or significant third-party blocklist presence (0 count) has been recorded to date.

This domain is currently active and under active investigation. Due to its low detection footprint and recent deployment, it poses a growing risk to crypto users. Immediate defensive measures include blacklisting the domain, IP, and associated SSL certificate. SOC teams are advised to monitor for outbound connections to this IP from internal networks and inspect endpoints for wallet connection attempts. The risk level remains under investigation pending further intel, but early containment is strongly recommended.