volcano-shop[.]pro

PhishDestroy identifies volcano-shop.pro as an active crypto drainer phishing domain with an elevated risk level. This domain mimics legitimate e-commerce platforms to deceive cryptocurrency users into connecting wallets and authorizing malicious transactions. The threat involves unauthorized fund transfers via smart contract interactions, posing significant financial risk to victims who engage with the site.

This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating low but present detection coverage. It was registered through HOSTINGER operations, UAB on June 21, 2025, and resolves to IP address 168.220.91.95, which is associated with a Let's Encrypt SSL certificate. The recent creation date suggests opportunistic targeting, while the low VT detection rate underscores the need for proactive user verification. There are no reported blocklist entries as of this assessment, indicating this campaign may be newly emergent or narrowly targeted.

To mitigate risk, users should avoid clicking links to volcano-shop.pro and verify the authenticity of any e-commerce site before entering information or connecting wallets. Block the domain at DNS and network levels using IOCs: domain volcano-shop.pro, IP 168.220.91.95. Report any suspicious transactions immediately to your wallet provider and local cybercrime units. Exercise caution with domains registered in the past 30 days, especially those using free SSL certificates or low-cost hosting registrars.