anubisqr57mqcf3vfqv3hknwbpux5ioqs6atmpwrqive6x6wrkdtrwyd[.]top

PhishDestroy identifies the domain anubisqr57mqcf3vfqv3hknwbpux5ioqs6atmpwrqive6x6wrkdtrwyd as an active generic phishing page posing as Anubis Marketplace, currently deploying a crypto drainer kit. The page title reads "Anubis Marketplace," indicating a direct impersonation of a known cryptocurrency service to deceive users into connecting wallets or submitting credentials. The domain was registered on February 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 188.114.97.3. The SSL certificate is issued by Google Trust Services, which may increase initial trust perception despite malicious intent. This campaign is categorized as a crypto drainer due to the active impersonation of a marketplace and the presence of drainer functionality targeting cryptocurrency wallets.

EXACT technical indicators for this domain include a VirusTotal detection score of 3/95, indicating universal evasion of current antivirus signatures as of the time of analysis. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain resolves to IP 188.114.97.3. The domain is not flagged by Google Safe Browsing (GSB) and has not been added to common threat blocklists. The domain was created on February 04, 2026, making it a very recent registration, a common tactic in phishing campaigns to avoid historical detection.

As of the latest checks, the domain remains active and unblocked, with the phishing page still accessible. Response actions include monitoring for domain takedown requests and sharing indicators with domain registrars and threat intelligence platforms. Remaining risk is high due to zero detections, active hosting, and the use of a plausible impersonation target. Users are strongly advised to avoid interacting with this domain, verify URLs before entering credentials or connecting wallets, and report any suspicious activity involving cryptocurrency transactions to their security teams or relevant platforms.