canalexpressodtrnsc[.]com

PhishDestroy identifies canalexpressodtrnsc.com as an active crypto drainer domain designed to steal cryptocurrency from unsuspecting users. This malicious site employs deceptive tactics, including impersonation of legitimate services, to trick visitors into connecting their crypto wallets. Once a user interacts with the fraudulent interface, the site initiates unauthorized transactions, draining funds directly from connected wallets without consent. Security researchers have observed this domain actively resolving to 147.79.84.209, where it hosts malicious scripts that monitor wallet connections and execute theft operations. This domain was flagged with 0 out of 95 VirusTotal detections at the time of analysis, indicating that mainstream security tools have not yet identified its malicious nature. Registered through HOSTINGER operations, UAB, the domain was created on April 30, 2026, making it a very recent threat with minimal historical data. The use of a Let’s Encrypt SSL certificate further enhances its credibility, tricking users into believing it is a legitimate service. Early indicators suggest this domain has not yet been added to most blocklists, increasing the risk of exposure to potential victims. If you or someone you know has visited canalexpressodtrnsc.com, immediately disconnect any connected crypto wallets and revoke permissions through your wallet provider’s security settings. Do not interact with any prompts or transaction requests from this domain. Report the incident to PhishDestroy for further analysis and to contribute to community defense efforts. Users should also clear their browser cache and disable any saved credentials for this site. Stay vigilant and verify URLs before entering sensitive information or connecting digital assets.