sco[.]apps[.]org[.]pe

The domain sco.apps.org.pe is actively hosting a crypto drainer that masquerades as a legitimate login page for cryptocurrency wallets. When users enter their wallet credentials or connect their wallets to this malicious site, the threat actor silently drains funds by transferring assets to controlled wallets. This is a high-risk threat that can result in irreversible financial losses for victims. The domain mimics legitimate cryptocurrency service interfaces to deceive users into entering sensitive information or authorizing malicious transactions. PhishDestroy identifies this domain as dangerous based on multiple security vendor flags. VirusTotal shows that 15 out of 95 security vendors have marked this domain as malicious, while Google Safe Browsing categorizes it under SOCIAL_ENGINEERING. This domain was registered through NIC.PE and is currently resolving to the IP address 43.131.52.41. It holds a valid SSL certificate issued by Let's Encrypt, which may give users a false sense of security. The domain's SSL certificate and clean-looking structure are tactics commonly used by phishers to appear legitimate and bypass initial scrutiny. If you have visited sco.apps.org.pe or entered any information on the site, act immediately to secure your accounts. Disconnect any wallets or devices that interacted with the domain, revoke any unauthorized connections or approvals, and transfer remaining funds to a new wallet. Run a full antivirus scan on your device to check for any lingering malware. Report the incident to your wallet provider and relevant cryptocurrency platforms. Always verify URLs manually and use trusted sources like PhishDestroy to check domain reputations before entering sensitive information or connecting wallets.