kushyprods3[.]info

PhishDestroy identifies kushyprods3.info as a live fake-cannabis-dispensary phishing domain designed to harvest payment card and wallet credentials. The landing page mimics a legitimate Kushy Picks storefront, mirroring branding, checkout flow, and even fake product images to lower victim suspicion. A custom drainer kit is served after the user clicks 'Checkout'; it fingerprints the browser, loads a fake payment form, and silently exfiltrates entered data to a Telegram bot controlled by the actor. This kit has not yet been observed on VirusTotal, indicating it is newly deployed and under the radar.

Technical indicators show the domain resolves to IPv4 104.21.58.59, was registered on May 04, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED, and holds a valid Let’s Encrypt TLS certificate. VirusTotal currently scores the URL 2/95 detections, Google Safe Browsing has no current blocklist entry, and public blocklists report zero third-party listings. Domain age is extremely fresh (registered May 04, 2026), which reduces historical reputation signals but increases the chance the site is short-lived.

The domain remains active at the time of this assessment. No remediation actions have been observed from hosting providers or registrars. PhishDestroy recommends immediate browser-level blocking via DNS filtering (e.g., block 104.21.58.59), disabling JavaScript on unknown cannabis checkout pages, and verifying any Kushy Picks purchase via official social channels. Remaining risk is MEDIUM due to the active drainer kit, fresh infrastructure, and absence of takedown actions; users should treat any payment interaction on this domain as compromised.