joinstreamers[.]live

The domain joinstreamers.live has been confirmed as a crypto drainer phishing site targeting cryptocurrency wallet credentials and funds. Analysis indicates the site is currently offline, though prior activity suggests it operated as a fraudulent platform designed to siphon digital assets from victims. No specific brand impersonation was observed, but the site employed deceptive tactics typical of crypto-related scams, including fake reward offers and wallet connection prompts. Infrastructure analysis reveals the domain was registered on April 30, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 172.67.215.108. Security vendors flagged this domain in 5 of 95 VirusTotal scans, while independent blocklists—including MetaMask, PhishDestroy, SEAL, and Maltrail—have classified it as malicious. The site’s trust score stands at 0/100, further corroborating its fraudulent nature. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare services, with HTTP/3 and Cloudflare Browser Insights actively employed to obscure tracking and evade detection. As of the latest assessment, joinstreamers.live remains offline, though its infrastructure could be reactivated under a new domain or IP. Users are advised to block the domain and associated IP at the network level, revoke any connected wallet permissions, and monitor for unauthorized transactions. Cryptocurrency holders should verify all wallet interaction requests through official channels and avoid engaging with unsolicited reward offers. Organizations should update endpoint protection rules to include this domain and its resolved IP in threat intelligence feeds.