{
 "slug": "noir-drainer-dns-txt-c2-oct-2026",
 "title": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
 "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026",
 "json": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json",
 "status": "live",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "ai": {
  "role": "ai-malware",
  "note": "Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it."
 },
 "chains": [
  "multi-evm"
 ],
 "method": "drainer-kit",
 "product": "Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages",
 "tags": [
  "multi-evm",
  "drainer-kit",
  "drainer-as-a-service",
  "noir-drainer",
  "dns-txt",
  "doh",
  "cloudflare-pages",
  "netlify",
  "walletconnect",
  "fake-airdrop",
  "infoblox",
  "ai"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-10-09",
 "closedAt": null,
 "updatedAt": "2026-10-22T21:53:35.016Z",
 "summary": "Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.",
 "timeline": [
  {
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer",
   "url": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "publisher": "Infoblox Threat Intel",
   "date": "2026-10-09"
  }
 ],
 "indicators": {
  "domains": [
   "noir[.]black",
   "_r.noir[.]black",
   "render-984.pages[.]dev",
   "listchoiseopenleaderboardseptember.netlify[.]app"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you connected a wallet to a 'community vote', 'airdrop eligibility check' or swap page reached from a link (not the project's own site) and approved a token permission, you may be affected.\n\n## What to do now\n- Revoke token approvals and Permit2 allowances you do not recognise.\n- Disconnect stale WalletConnect sessions and move funds if you approved anything unknown.\n\n## How to avoid this\n- Reach dApps by typing the address or using a saved bookmark, not from ads, replies or DMs.\n- Be wary of 'Desktop browser required' gates and fake voting pages; real projects rarely need a wallet to vote on a listing.\n- Network admins can block public DoH and the listed domains.",
 "notes": null,
 "agentBrief": "# Noir wallet drainer kit hides its backend behind DNS TXT records and DoH\n\n- Severity: High · Status: Still active (live)\n- Chains: Multiple EVM chains · Method: Drainer kits (drainer-as-a-service)\n- Started: Oct 9, 2026 · Last update: Oct 22, 2026\n- Who/what: Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages\n- AI involvement: AI-built malware. Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it.\n\nInfoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.\n\n## Am I affected?\nIf you connected a wallet to a 'community vote', 'airdrop eligibility check' or swap page reached from a link (not the project's own site) and approved a token permission, you may be affected.\n\n## What to do now\n- Revoke token approvals and Permit2 allowances you do not recognise.\n- Disconnect stale WalletConnect sessions and move funds if you approved anything unknown.\n\n## How to avoid this\n- Reach dApps by typing the address or using a saved bookmark, not from ads, replies or DMs.\n- Be wary of 'Desktop browser required' gates and fake voting pages; real projects rarely need a wallet to vote on a listing.\n- Network admins can block public DoH and the listed domains.\n\n## Indicators (block these, never visit them)\n- Domain: noir[.]black\n- Domain: _r.noir[.]black\n- Domain: render-984.pages[.]dev\n- Domain: listchoiseopenleaderboardseptember.netlify[.]app\n\n## Sources\n- DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer (Infoblox Threat Intel, 2026-10-09): https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/\n\nFull record: https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026 · JSON: https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}