Cracked crypto wallet with classified breach data and surveillance feed overlay.

Domain dossier / preserved indicators

Redacted domain dossier, minus the house style

We are far too editorially nervous to tell you whether the upstream publisher is correct. We can, however, preserve the dossier, keep the indicators readable, and route every external exit through the source gate.

Domain fileIndicators preservedSource gate wrapped

Open source gate Archive FAQ Registrar ledger

File /domain/d1-ojKwYzq7nkeBmjW4pEi6/·Source voice preserved·Brand labels redacted

THE ENABLERS REGISTRY AI

HIGH

Domain [REDACTED] has been identified as an active generic possibly phishing host operating under investigation with a risk level flagged as active through seed 10ceb0. This domain does not yet impersonate a specific high-value brand such as Facebook or PayPal but instead leverages a crypto betting theme to deceive users seeking online wagering platforms. The site is currently distributing a cryptocurrency drainer kit designed to siphon digital assets from victims’ wallets without consent. This infrastructure is part of an emerging campaign targeting users searching for decentralized betting opportunities.

This domain was registered on March 10, 2026, through [REDACTED], and resolves to IP address 172.67.149.67. It utilizes a Let's Encrypt SSL certificate for added legitimacy. As of this report, VirusTotal shows zero detections across 95 scanning engines, indicating this threat remains undetected by most antivirus solutions. Given its recent creation and clean VT score, it has not yet appeared on major blocklists, including Google Safe Browsing (GSB). The absence of historical possibly phishing or malware associations suggests this is a newly deployed threat actor asset.

THE ENABLERS REGISTRY has flagged [REDACTED] as active with an under-investigation status, and immediate response actions are underway to block this domain across user networks. Despite low current detection rates and no prior listings, the recent domain creation and lack of SSL warnings make it a credible immediate threat. Users are strongly advised to avoid visiting this domain and to report any interactions to THE ENABLERS REGISTRY for further analysis. Remaining risk is assessed as high due to the combination of recent registration, zero detections, and active deployment of a crypto drainer payload. Proactive blocking of [REDACTED] and its associated IP is recommended to prevent asset loss.

VirusTotal

4 det.

URLScan

Report ↗

Gridinsoft

0/100

Scamadviser

1/100

SSL

Let's Encrypt

Age

4 mo

Observed status

Cloaked · reachable 403

DestroyList

Listed

Reports Sent

9 ignored

Data coverage VirusTotal 4 / 94 URLQuery no detections OTX no pulses CF Radar clean URLScan report ready DNS blocks none SSL valid, 56d WHOIS 4 mo old Screenshot not captured Redirect chain not probed Gridinsoft 0/100 Scamadviser 1/100

Threat Response Pipeline

Discovery

Checks

Reports

Availability

16/17

Pre-emptive Discovery & Ingestion

Threat Ingested

1/1 ✓

Threat Ingested

[REDACTED] detected and queued for full analysis

Apr 13, 2026

Threat Intelligence Checks

IANA #1910 Radar · VirusTotal · Google Safe Browsing · Forensic Evidence Collected · Technical Analysis Recorded

5/5 ✓

IANA #1910 Radar

Scanned via IANA #1910 Radar — DNS, certificates & network data

VirusTotal

4 / 94 vendors flagged on VirusTotal

Jul 18, 2026

Google Safe Browsing

Checked via Google Transparency Report

Apr 13, 2026

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Jul 27, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · ICANN Escalation #8 · ICANN Escalation #9 · 8 Reports Filed

9/9 ✓

Initial Abuse Report (#1)

Sent to 3 abuse contacts at [REDACTED] with forensic evidence