Is This Site Legit? Blacklists Miss New Scams

What the latest drainer campaign actually exploits

Public reporting on the Vanilla Drainer service describes 5.27 million dollars stolen across roughly three weeks, with the single worst day on 5 August 2026 costing victims about 3.09 million dollars in stablecoins. The operational detail in that reporting matters more than the number: the service evades detection by creating a new contract for each malicious site and changing domain names frequently.

Read that as an engineering decision and the logic is plain. The defender's most common tool is a list of things previously seen doing harm. An operator who never reuses a domain or a contract never appears on that list. There is no need to defeat the check. The operator arrives before it has anything to say.

Security guidance for 2026 keeps arriving at the same conclusion from the other direction: most losses come from social engineering rather than blockchain hacks, pressure that gets someone to approve a transaction on a convincing page. The page is the weapon, and the page is also the part that is brand new every time.

Domain rotation

The practice of running a scam from a constant stream of freshly registered domains, each retired before it accumulates reports, so that reputation and blacklist based checks have no history to find. The infrastructure, the wording and the payout address may stay the same while the hostname changes daily.

Why a blacklist cannot help you here

A blacklist answers a question about the past. It is genuinely useful for that, and we consume several of them. But there is a structural gap between the moment a site starts stealing and the moment enough victims have reported it, and the entire drainer economy lives inside that gap. Four things go wrong at once:

• No history produces a clean answer instead of an unknown one. Most consumer checkers present an absence of reports as reassurance, which for a domain registered this week is the opposite of what it means.
• Reports arrive after the money is gone. By the time a domain is listed, its useful life as an attack tool is over and the operator has moved on.
• The contract, the small program on the blockchain that the page asks your wallet to approve, is also deployed fresh for every site. Its address has no history either, so screening the destination against a list of known bad addresses fails for the same reason the domain check does.
• A valid certificate is free, and the padlock proves only that the connection is encrypted. It says nothing about whether the recipient is honest. Age cuts one way only: a domain registered this week is a warning sign, but an old domain is no clearance, because age is cheap to acquire.

What our own numbers look like

We assess sites on what they are doing rather than on who has complained. As of this writing our own published figures are:

• 3,053 websites assessed and scored to date
• 164 currently sitting in the two risk bands, of which 90 are graded critical and 74 low trust
• 1,861 graded high trust and 488 moderate, because a checker that never clears anything is useless
• 1,396,321 wallet addresses assessed on the on-chain side, with 758,807 carrying some degree of risk exposure
• 15,924 addresses currently recorded as frozen or blacklisted by stablecoin issuers, split 8,623 on Ethereum and 7,224 on TRON, representing about 2.64 billion dollars
• 236 independent taint source clusters that exposure is measured against

Every one of those verdicts is published with the evidence behind it rather than as a bare score, and the flagged and cleared sets are both browsable in the public directory. The aggregate picture is tracked in the TrustSniffer Risk Index, which we wrote about when it crossed 750,000 flagged wallets.

The 547 sites we refused to guess about

The number we are most willing to defend is an unflattering one. 547 of the sites in that set are marked needs review rather than given a trust grade. Those are cases where the site blocked our capture, or served so little that any score would have been invention: a bot challenge, an empty shell, an aggressive firewall.

A scoring engine will produce a number from any input. The temptation is to let a thin capture collapse into a bad grade, because a confident answer looks more competent than an admission. We treat that as a defect and floor those cases into a visible yellow state instead. If you are relying on a verdict to decide whether to send money, a guess dressed as a verdict is worse than being told plainly that we could not see enough.

The wallet side has exactly the same problem

A newly deployed drainer contract is unlisted for the same reason a newly registered domain is. The useful question is therefore how many transfers separate this address from money that a stablecoin issuer has already frozen or that sits under sanctions. That is a graph distance question, and distance survives the address being new.

Our on-chain risk engine traces exposure backwards through transfers from frozen and sanctioned sources across Ethereum and TRON. Each transfer between two addresses counts as one hop. A fresh address that received funds two hops from a frozen cluster, meaning the money passed through one intermediary wallet on its way from a group of addresses an issuer has frozen, reports as exposed even though no list has ever named it. One hop of separation is no clean bill of health either, and we have shown what a single hop from a sanctioned source looks like in a real TRON case.

The World Cup wave is already building

If you want to see domain rotation industrialised, watch the next few months. Researchers have already documented World Cup 2026 attack infrastructure including a wallet drainer impersonating a well known gambling brand, a typosquatted ticket selling site, and advance fee fraud claiming lottery winnings. Every one of those needs a plausible hostname, and every one of those hostnames will be new.

Typosquatting is the cheapest version of this and it works on people who are being careful. We published the anatomy of one such case where a single wrong character in a domain, pancakeswap.come rather than the real thing, was the whole attack. Nothing about that domain was on a blacklist when we assessed it. Everything about how it behaved gave it away.

How to check a site that has no history

1. Assess the live page. Our website trust analysis captures the site as it is served right now, including its infrastructure, its registration continuity, its archive history and its behaviour in a sandbox, then grades what it found. Read the grade alongside the evidence published with it.
2. Treat an unknown domain as unknown. If a checker cannot distinguish no reports from safe, its clean answer carries no information about a domain registered this week.
3. Screen the payout address separately with the wallet risk checker. The site and the destination fail independently, and the address often has exposure even when the domain is spotless.
4. Check the exact spelling character by character against the brand you believe you are visiting. Typosquats survive because nobody reads the hostname twice.
5. Refuse to approve a transaction you did not initiate. Most 2026 losses come from an approval on a convincing page.
6. When a verdict says needs review, read it as needs review. Absence of evidence is the one output that should not be rounded up to safe.

Method and provenance. Site and wallet counts are TrustSniffer's own published figures at the time of writing, taken from our live public statistics and Risk Index snapshot, and they move daily as new assessments land. Third party loss figures and campaign tradecraft are attributed inline to the linked external reporting and are not our measurements. We name no site in this article as fraudulent on the basis of a low score alone: a low grade can reflect a blocked capture rather than misconduct, which is precisely why the needs review state exists.