heavendexv2[.]xyz

The domain heavendexv2.xyz is currently active and engaged in a crypto drainer phishing campaign targeting users of the decentralized finance protocol Compound. Analysis indicates this is a brand impersonation threat, designed to deceive victims into connecting wallets to malicious smart contracts under the guise of a token migration process. The page title, 'HeavenDEX V2 — Token Migration,' reinforces the false legitimacy of the operation, while the underlying infrastructure facilitates unauthorized asset transfers from compromised wallets. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which is part of a network known for hosting phishing and scam-related content. Detection metrics show that 3 of 95 security vendors on VirusTotal have flagged the domain as malicious, and it appears on at least one security blocklist. The Gridinsoft trust score for the domain is 0 out of 100, further indicating its high-risk nature. Technologies detected include HSTS, crypto-js, cdnjs, Cloudflare, and HTTP/3, suggesting an attempt to mimic legitimate platforms while obscuring malicious activity behind common web security and performance tools. The domain remains active and poses an elevated risk to users of the Compound protocol. Organizations and individuals are advised to block the domain and its associated IP at the network level. End users should be alerted to the presence of this campaign, particularly the use of fake token migration pages as a social engineering tactic. Wallet providers and decentralized application browsers are recommended to integrate detection for this domain into their security layers to prevent user exposure. Continuous monitoring of newly registered domains under the same registrar is advised to identify potential follow-up campaigns.