mytax-organizere5004e2e-8747-4930-a8d8-ed2d8c12c7e2[.]ccc-food[.]com

PhishDestroy identifies active phishing infrastructure linked to a malicious domain that specifically targets users seeking tax organization tools. The domain mytax-organizere5004e2e-8747-4930-a8d8-ed2d8c12c7e2.ccc-food.com operates as a crypto drainer, designed to trick victims into connecting cryptocurrency wallets under the false pretense of tax filing assistance. This threat is currently active and poses a significant risk to individuals accessing financial or tax-related services online.

This domain was flagged by 12 of 95 VirusTotal security vendors, indicating moderate but concerning detection across major threat intelligence platforms. The domain was registered through Dynadot Inc on November 03, 2025, and resolves to IP address 192.185.156.195. It has been observed on 2 security blocklists and utilizes a Let's Encrypt SSL certificate for fraudulent legitimacy. PhishDestroy notes that this domain is already blocked by OpenPhish and PhishingArmy, reinforcing its malicious classification. The combination of recent creation, low detection ratio, and active hosting on a suspicious IP underscores the elevated threat level of this campaign.

Given the active status of this crypto drainer and its use of deceptive naming to impersonate legitimate tax organization services, PhishDestroy recommends immediate avoidance of this domain and any associated URLs. Users are advised to verify the authenticity of tax-related websites through trusted channels and to use security tools such as browser-based phishing filters or dedicated threat intelligence platforms. Organizations should update blocklists with this domain and IP (192.185.156.195) to prevent employee exposure. Continuous monitoring of this domain is advised due to the evolving nature of crypto drainer campaigns and the potential for expanded infrastructure.