rest-icon-handler[.]store

This domain is flagged as an elevated-risk crypto drainer, a threat type designed to siphon cryptocurrency assets from connected wallets through malicious smart contract interactions. Analysis indicates rest-icon-handler.store employs deceptive frontend elements mimicking legitimate dApp interfaces, likely targeting users of decentralized finance platforms or NFT marketplaces. The domain’s infrastructure and behavioral patterns align with known crypto drainer campaigns, where victims unknowingly authorize transactions that transfer funds to attacker-controlled addresses. Infrastructure analysis reveals the domain was registered on February 06, 2026, through HOSTINGER operations, UAB, and resolves to the IP address 216.198.79.1. It is detected by 5 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and Maltrail. Detected technologies include Node.js, Vercel, Express, and HSTS, suggesting a modern, cloud-based deployment. The SSL certificate is issued by Let’s Encrypt, providing encrypted connections that may lend a false sense of legitimacy to potential victims. Mitigation steps for this threat type include immediately revoking any wallet permissions granted to rest-icon-handler.store via blockchain explorers or wallet interfaces. Users should verify transaction requests on-chain before approval and employ hardware wallets or isolated software wallets for high-value interactions. Network-level protections, such as DNS filtering or endpoint detection rules blocking 216.198.79.1 and associated domains, can prevent access. Organizations should update security policies to flag domains registered within the last 90 days and those using hosting providers frequently abused for malicious campaigns. Post-exposure, victims should transfer remaining assets to a new wallet and monitor for unauthorized transactions.