spax50b[.]org

PhishDestroy identifies the domain spax50b.org as an active crypto drainer scam currently under investigation for impersonating a legitimate AI-powered token presale. This fraudulent landing page lures victims with promises of early bonus allocations, using deceptive tactics to extract cryptocurrency through malicious wallet connections. The operation is currently classified as an active threat, with threat actors actively promoting the domain across social media and crypto-focused platforms to drive traffic and maximize illicit gains.

This domain was flagged by 2 of 95 VirusTotal vendors as of the latest scan, indicating a low initial detection rate despite clear red flags. The domain was registered through Internet Domain Service BS Corp on April 24, 2025, and resolves to IP 64.29.17.1. Its SSL certificate is issued by Let’s Encrypt, and the page title mirrors legitimate presale landing pages to enhance credibility. The absence of blocklist presence and low trust scores suggest this campaign is either newly operational or deliberately evading detection through infrastructure obfuscation.

As the investigation continues, PhishDestroy recommends immediate caution when encountering spax50b.org or related links. Users should avoid interacting with the site, refrain from connecting wallets, and verify any presale offers through official project channels. Organizations and security teams are advised to monitor traffic to this domain and report findings to threat intelligence platforms. Blocking the domain at the network level and updating endpoint protection signatures can prevent exposure. PhishDestroy will continue monitoring and updating this report as new intelligence emerges.