purplebtc-allocations[.]xyz

PhishDestroy identifies purplebtc-allocations.xyz as an active crypto drainer domain designed to mimic legitimate PurpleBTC transaction allocations. The page likely employs deceptive UI elements such as fake transaction confirmations or wallet connection prompts to trick users into authorizing malicious token transfers or signing malicious transactions that drain funds. While no drainer kit has been publicly analyzed, the domain’s behavior aligns with common crypto impersonation tactics used in phishing campaigns targeting blockchain users.

This domain exhibits multiple high-risk technical indicators. VirusTotal currently shows 11 out of 95 detection engines flagging the site, suggesting limited coverage by security vendors. It resolves to IP 188.114.96.3, hosted on infrastructure associated with malicious activity. The domain was registered on May 12, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently exploited in bulk malicious registrations. It holds a valid Let’s Encrypt SSL certificate, likely to appear legitimate. Google Safe Browsing has already listed the domain, and it appears on 1 external blocklist. MetaMask has actively blocked connections to this domain.

As of this report, purplebtc-allocations.xyz remains active and under investigation, with a status of “active” and risk level “under_investigation.” The domain continues to pose imminent risk to users who may confuse it with the legitimate PurpleBTC platform. Security researchers are advised to monitor for drainer kit artifacts and update blocklists immediately. Users should treat this domain as hostile. Avoid clicking links, visiting the site, or connecting wallets. If already exposed, revoke any unauthorized token approvals and check wallet transaction history for signs of unauthorized transfers. Report the domain to security vendors and browsers to accelerate takedown.