futunhtkjkt[.]com

The domain futunhtkjkt.com is currently active and operates as a crypto drainer phishing site targeting users of futures trading platforms. Analysis indicates the site is designed to harvest login credentials and drain cryptocurrency wallets by impersonating legitimate trading interfaces. The domain remains accessible and poses a high risk to users who interact with it. Infrastructure analysis reveals the domain was registered on March 20, 2026, through GMO Internet, Inc., a registrar frequently associated with phishing activity. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendors have flagged the domain, with 5 of 95 VirusTotal engines detecting malicious activity. The site appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy and MetaMask. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its low-cost, automated issuance process. As of the latest verification, futunhtkjkt.com remains active and continues to resolve to its Cloudflare-hosted IP. Users are strongly advised to avoid interacting with the domain or entering any credentials on the site. Network administrators should block the domain and its associated IP at the perimeter level. Individuals who may have already engaged with the site should immediately revoke any connected wallet permissions, transfer remaining assets to a secure wallet, and monitor accounts for unauthorized transactions. The creation date discrepancy (2026) suggests potential domain spoofing or a typo-squatting attempt, further emphasizing the need for caution.