lluuxxa6238[.]cfd

The PhishDestroy threat intelligence team has identified lluuxxa6238.cfd as an active crypto drainer campaign under investigation. The domain is currently flagged by Google Safe Browsing for SOCIAL_ENGINEERING tactics and remains unblocked by most security vendors, posing a moderate but evolving risk to cryptocurrency users. This domain is not yet widely recognized as malicious, but its recent registration and infrastructure choices suggest an emerging threat vector requiring immediate attention.

This domain was flagged by Google Safe Browsing for SOCIAL_ENGINEERING and currently shows 0 detections out of 95 VirusTotal vendors, indicating a low initial detection rate despite suspicious infrastructure. It resolves to IP 163.181.214.4 and was registered through Aceville Pte. Ltd. on March 26, 2026. The domain uses a Let's Encrypt SSL certificate to enhance legitimacy, a common tactic among crypto drainer operators to bypass browser warnings. Trust scores are not yet available, but the combination of recent registration, low detection rates, and active status suggests this is an early-stage campaign with potential for rapid expansion.

Current status indicates active operation with limited blocking, making this domain a high-priority target for security teams and cryptocurrency platforms. Organizations should monitor lluuxxa6238.cfd for related indicators, block the domain at DNS and network levels, and review SSL certificate issuance patterns from Let's Encrypt for similar domains. Users should avoid interacting with this domain, verify all crypto transaction URLs manually, and report any suspicious activity to their security teams. Immediate defensive action is recommended due to the domain's active status and low initial detection rate.