# PhishDestroy threat dossier — gro77z-fxempire.com ================================================================ Fetched: 2026-05-02 11:36:00 UTC Canonical: https://phishdestroy.io/domain/gro77z-fxempire.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 72/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/94 security vendors flagged this domain Flagging vendors: Fortinet ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.87.32 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Ultahost, Inc. Nameservers: simon.ns.cloudflare.com, sloan.ns.cloudflare.com Registered: 2026-04-14 Page title: GRO77Z Presale: Elon Musk’s AI-Blockchain Vision Captures Global Investor Imagination | FXEmpire HTTP response: 530 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-13 Status: INVALID chain Fingerprint: 2451f0ed459f4452c2e5630b6304bc935d1884e481ca0ee04ff37f2a0b574a85 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-15 07:10:34 UTC (by PhishDestroy tracker) First reported: 2026-04-15 04:11:29 UTC (abuse notice filed) Last verified: 2026-05-02 12:19:38 UTC Neutralised: 2026-04-23 04:06:30 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d8f54-1be1-74b8-ac2c-a207e6701d77/ URLQuery: https://urlquery.net/report/9de22bdd-ad88-4603-81ea-a684d601e8c2 Wayback Machine: https://web.archive.org/web/*/gro77z-fxempire.com crt.sh CT logs: https://crt.sh/?q=%25.gro77z-fxempire.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=gro77z-fxempire.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/gro77z-fxempire.com URLhaus: https://urlhaus.abuse.ch/host/gro77z-fxempire.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-15 07:11:06 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies gro77z-fxempire.com as an active crypto drainer site impersonating the FXEmpire brand, designed to steal cryptocurrency through fraudulent transactions. The domain employs a deceptive interface mimicking legitimate financial platforms to trick users into connecting crypto wallets and approving malicious transactions. Technical analysis confirms the presence of a drainer kit embedded in the website’s JavaScript, which automatically siphons approved funds upon wallet signature. This domain represents a direct threat to cryptocurrency investors and users of financial trading platforms. This domain was flagged on April 14, 2026, just hours after creation, indicating a fast-acting threat actor leveraging newly registered infrastructure. It resolves to IP address 104.21.87.32 and utilizes a legitimate Let’s Encrypt SSL certificate to appear trustworthy. The domain is registered through Ultahost, Inc., a hosting provider often exploited by malicious actors due to lax abuse monitoring. VirusTotal reports a low 1/95 detection rate as of seed 969a50, highlighting the challenge of early-stage threat identification. The domain is currently unlisted on Google Safe Browsing (GSB) and has not yet propagated widely across major threat intelligence feeds, increasing its potential reach. As of this report, gro77z-fxempire.com remains active and poses an elevated risk to visitors. Users who have interacted with this site are advised to revoke any wallet connections immediately and transfer remaining assets to a secure, hardware-backed wallet. All crypto drainer domains should be blocked at the network and DNS levels. This domain is expected to persist until reported to hosting providers and registrars for takedown. The remaining risk is high due to the domain’s recent registration, low detection rate, and lack of widespread blocking. Immediate action is required to prevent further victimization. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260415-5814DE Favicon MD5: 68c2a15987e5426defc0ba989cc19dab TLS cert SHA-256: 2451f0ed459f4452c2e5630b6304bc935d1884e481ca0ee04ff37f2a0b574a85 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/gro77z-fxempire.com/ JSON API: https://api.destroy.tools/v1/check?domain=gro77z-fxempire.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io