bot[.]security-protection[.]xyz

PhishDestroy identifies a live fake antivirus phishing campaign hosted at bot.security-protection.xyz tagged as generic_phishing under seed 40815c. The domain masquerades as a legitimate security service, leveraging a trustworthy-looking name and Let's Encrypt SSL to deceive users. No specific drainer kit fingerprint has been extracted at this stage, but the page likely mimics a browser warning or system scan to trick victims into downloading malicious payloads or surrendering credentials. The domain does not overtly impersonate a well-known brand, reducing immediate recognition-based blocking but increasing reliance on behavioral detection.

This domain was flagged on April 14, 2026, via Dynadot LLC with a Let's Encrypt SSL certificate bound to IP 104.21.10.46. VirusTotal analysis shows 0 detections out of 95 engines, indicating low signature coverage. The domain remains unlisted in Google Safe Browsing (GSB) and has not yet appeared on major threat intelligence blocklists. Registrar data indicates recent acquisition, and the IP is hosted on Cloudflare, commonly used to obfuscate origin and evade takedowns.

As of this report, the campaign is active and under active monitoring. No takedown actions have been initiated due to low initial detection rates. The remaining risk is moderate: although no drainer signatures are confirmed, the domain's false trust signals make it highly effective at deceiving non-technical users. Users should avoid visiting or interacting with bot.security-protection.xyz. Web filters should block both the domain and IP range 104.21.10.0/24 until further notice. Security teams are advised to monitor for new hashes, C2 callbacks, or lateral movement from affected endpoints.