interface-frax[.]xyz

PhishDestroy identifies interface-frax.xyz as an active crypto wallet phishing domain currently under investigation for fraudulent credential harvesting activities. This domain is not a generic phishing site but specifically targets users of Frax Finance and related decentralized finance platforms, mimicking official interfaces to steal private keys and wallet credentials. The threat remains active and is being monitored for further malicious behavior or infrastructure changes.

This domain was flagged by zero of 95 VirusTotal vendors as of the latest scan, indicating no immediate detection by mainstream security engines despite its suspicious registration and hosting patterns. The domain was registered through Dynadot LLC on January 24, 2026, and resolves to IP address 188.114.96.3. It holds an SSL certificate issued by Google Trust Services, which does not inherently validate legitimacy. Historical data shows this domain has not been listed on any major blocklists, though its recent creation and lack of reputation suggest elevated risk. Current trust scores across threat intelligence platforms remain critically low due to the absence of historical activity and association with known malicious infrastructure.

Current status indicates the domain is actively resolving and serving content designed to deceive users into entering sensitive wallet information. This poses a high risk to cryptocurrency users, particularly those interacting with Frax Finance or similar DeFi protocols. Security teams and end users are advised to block this domain at the network and host levels and avoid accessing it via any means. If exposure has occurred, users should immediately revoke any entered credentials, transfer funds to new wallets, and scan devices for malware. Organizations are recommended to update firewall rules, DNS blocklists, and security awareness training to include warnings about this specific domain and its impersonation tactics.