jaudux[.]com

PhishDestroy identifies jaudux.com as an active cryptocurrency drainer distributing malicious payloads through generic phishing lures. This domain impersonates legitimate cryptocurrency services to trick users into connecting wallets and draining funds. The threat actor leverages a pseudo-generic domain to evade initial detection while hosting a drainer kit designed to target MetaMask, WalletConnect, and other Web3 wallet integrations. Technical analysis reveals the campaign is operational and actively redirecting victims to wallet-draining interfaces.

Technical indicators confirm elevated risk: VirusTotal flags 2 of 95 security engines for malicious content, while the domain resolves to IP 188.114.97.3. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 7, 2026, the domain uses a Let's Encrypt SSL certificate to appear legitimate. As of current analysis, Google Safe Browsing (GSB) has not added jaudux.com to its blocklist, and VirusTotal shows limited vendor coverage despite active abuse. These factors suggest early-stage deployment with potential for rapid expansion across multiple blocklists.

The campaign remains active with high risk of continued victimization. PhishDestroy advises immediate domain blacklisting and user caution when encountering links associated with jaudux.com. Current mitigation includes network-level blocking at the DNS and IP levels, but the attacker may rapidly shift infrastructure. Users are strongly urged to verify any cryptocurrency-related domain using PhishDestroy’s real-time lookup tool before engaging with wallet connections or transactions. Remaining risk is elevated due to low initial detection coverage and active domain age post-registration.