hotjack[.]us

The domain hotjack.us was a generic phishing site targeting cryptocurrency users. It presented itself as a blockchain-based online casino under the name 'HOTJACK' but operated as a scam to deceive victims into transferring funds or revealing sensitive information. No legitimate brand was impersonated, and no known drainer kit was identified. The site is currently taken offline, but it remains a confirmed phishing threat with an elevated risk level.

Technical analysis shows that hotjack.us was flagged by 2 of 95 security vendors on VirusTotal, including Netcraft and SOCRadar, while Google Safe Browsing did not detect it. The domain was registered through NameCheap, Inc. on August 18, 2025, and resolved to the IP address 172.67.168.61, hosted on Cloudflare's infrastructure (AS13335). It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'HOTJACK | Play at the best online casino based on Blockchain', and the domain's nameservers were alfred.ns.cloudflare.com and irena.ns.cloudflare.com.

Victims of hotjack.us should immediately revoke any token approvals granted to the site and transfer remaining funds to a new cryptocurrency wallet. Monitor transaction histories for unauthorized activity and report the incident to relevant platforms, such as the cryptocurrency exchange used or blockchain explorers. Additionally, report the phishing domain to Google Safe Browsing, PhishTank, and the domain registrar (NameCheap) to aid in takedown efforts. If login credentials were exposed, change passwords for associated accounts and enable two-factor authentication where possible.