escort[.]center

PhishDestroy has identified a dangerous phishing domain, escort.center, which is currently offline but poses a significant threat as a generic phishing site. The domain was found to be associated with a crypto drainer, a type of malware designed to steal cryptocurrency from victims' wallets. While the exact brand being impersonated is unclear, the domain's generic name suggests it may be used for broad-spectrum attacks aimed at tricking users into revealing sensitive financial information or connecting their wallets.

Technical indicators for this domain are alarming. VirusTotal reports that 6 out of 95 security vendors flag escort.center as malicious, indicating a moderate level of detection but still a considerable risk. The domain was registered through Fewmoretaps OU d/b/a Trustname.com and created on April 28, 2026, which is suspiciously recent. It resolves to IP address 185.246.189.151 and uses an SSL certificate from Let's Encrypt (E7), a common choice for phishing sites due to its free and automated issuance. Additionally, the domain appears on 1 security blocklist and was found in 1 threat intelligence pulse on AlienVault OTX, suggesting it has been flagged but not yet widely recognized.

As of now, escort.center is offline, which means the immediate threat has been mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with this domain monitor their accounts and wallets for suspicious activity. The domain's recent creation and the presence of a crypto drainer indicate a targeted effort to steal digital assets. Users are advised to verify any suspicious domains on PhishDestroy before engaging and to enable two-factor authentication on all sensitive accounts. While the domain is offline, attackers may use similar variations or new domains to continue their campaigns, so ongoing caution is essential.