clickemporium365[.]top

PhishDestroy identifies clickemporium365.top as an active generic phishing domain impersonating Microsoft 365 login portals to harvest credentials and deploy crypto drainer malware. The domain is registered under Dynadot LLC and resolves to IP 188.114.96.3. No specific drainer kit family has been isolated yet, but the threat type indicates credential theft via spoofed Microsoft login pages.

This domain was flagged with a VirusTotal detection score of 2/95 as of the latest scan, indicating no current antivirus signatures flag it. The domain was created on February 19, 2026, and secured with a Let's Encrypt SSL certificate. It remains unlisted on Google Safe Browsing (GSB) and has not been added to major blocklists, leaving users vulnerable to initial exposure. The lack of detections suggests emerging or highly targeted activity.

As of now, the domain status is active and under investigation, with PhishDestroy continuing to monitor its behavior and infrastructure. Users are advised to avoid interaction and verify any suspicious links through PhishDestroy’s real-time scanning tool. The remaining risk is classified as under_investigation due to low detection rates and recent registration, but the potential for credential theft and malware delivery remains high.