canna272i7uai6h5ctkrrfttwv2naulak37gctk22t6erohxegtu46yd[.]xyz

PhishDestroy identifies a newly active generic phishing site hosted at canna272i7uai6h5ctkrrfttwv2naulak37gctk22t6erohxegtu46yd.xyz, flagged for elevated risk and confirmed as a crypto drainer kit designed to harvest private keys and seed phrases. The domain uses no brand impersonation, relying purely on URL novelty and the appeal of cannabis-related branding to attract victims into connecting wallets and signing malicious transactions. At the time of discovery, the domain resolves to IP 188.114.97.3 via a Let’s Encrypt SSL certificate, indicating active HTTPS deployment to appear legitimate. This domain was registered on May 11, 2026, through NameSilo, LLC, giving it only weeks of operational history, which is typical for disposable drainer infrastructure. VirusTotal analysis returned a detection score of 1 out of 95 security vendors, highlighting its evasiveness against mainstream scanning tools. The domain remains unlisted on Google Safe Browsing (GSB) and shows zero appearance on major blocklists at the time of analysis, allowing it to circulate unchecked in crypto communities. These technical indicators suggest a recently deployed, low-signature threat with high potential for rapid victim acquisition before detection systems catch up. As of the latest scan, the domain remains active and classified as elevated risk. PhishDestroy continues to monitor and block this URL via seed eef135. All cryptocurrency users are advised to verify any .xyz links related to token airdrops or wallet connections using PhishDestroy’s real-time verification tool. The remaining risk remains elevated due to low vendor detection and short domain age, making proactive verification essential to prevent wallet compromise.