prxvt-app[.]live

This domain, prxvt-app.live, is flagged as a high-risk generic phishing threat targeting users of cross-chain private payment platforms. Analysis of the page title, 'px402 by PRXVT - Cross-Chain Private Payments,' indicates an attempt to impersonate legitimate cryptocurrency or blockchain-based financial services. The domain does not appear to be linked to a known drainer kit at this time, but the branding mimicry suggests intent to harvest credentials or private keys from unsuspecting victims under the guise of a privacy-focused payment solution.

Infrastructure analysis reveals the following technical indicators: the domain was registered on June 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.211.130, which is associated with a content delivery network. The SSL certificate is issued by Google Trust Services, providing a false sense of security. On VirusTotal, only 1 out of 95 security vendors currently flags this domain as malicious. No detections were reported on Google Safe Browsing at the time of analysis, and no additional blocklist entries were identified beyond the single vendor alert.

As of the latest verification, prxvt-app.live remains active and accessible. No takedown actions have been observed, and the domain continues to host its deceptive content. The low detection rate (1/95) combined with the recent registration date and plausible branding increases the risk of successful compromise, particularly among users of decentralized finance platforms. Recommended response actions include immediate blocking of the domain and IP at the network perimeter, alerting relevant security teams to monitor for credential theft or unauthorized transaction attempts, and advising users to verify payment service URLs through official channels only. The remaining risk is classified as high due to the domain's operational status and targeted nature.