lacalledelterror[.]mx

lacalledelterror.mx is a Spain-language domain leveraging local soccer passion and a terror-related term to lure victims into a fake sports-betting portal that silently loads a cryptocurrency drainer kit. This high-interaction phishing kit targets Spanish-speaking users primarily in Mexico, duplicating the visual identity of well-known betting brands and injecting obfuscated scripts to drain wallets on connect. Initial intelligence did not reveal any direct brand infringement on the betting side, but the drainer payload is the same family used in other Mexico-based campaigns that mimic house-hold services to harvest mnemonic phrases and private keys.

VT Total score of this site remains 0 detections out of 95 engines, reflecting low global coverage at the moment of scanning. The domain was registered on 23 June 2021 through MarkMonitor, pointing to dedicated IP 44.226.113.145. It holds a valid SSL certificate issued by Google Trust Services, which currently prevents most browsers from showing certificate warnings. As of the latest assessment the site is still active and not yet flagged on any public blocklist, indicating it exploits a brief window between deployment and detection.

PhishDestroy’s investigation started 5cea51 moments after the first telemetry hit; the domain is now under active analysis. Due to the zero detections across engines and absence from blocklists, end-users remain exposed despite none of the browsers or mail filters showing a warning. Recommended actions include immediate endpoint isolation if accessed, revocation of any TLS sessions originating from 44.226.113.145, and black-holing the MarkMonitor name servers until the drainer kit is fully extracted. The current risk is MEDIUM-HIGH despite the low VT score because the drainer can operate without AV detections and crypto losses are irreversible.