royalphone-sa[.]store

PhishDestroy identifies royalphone-sa.store as an active crypto drainer impersonating a phone service brand under investigation for fraudulent credential theft. The domain mimics Royal Phone (رويال فون) to deceive users into connecting wallets or submitting payment details, exploiting trust in localized telecom branding. No publicly identified drainer kit hash or script fingerprint is available, but the page title and Arabic localization suggest targeting Middle Eastern users familiar with the Royal Phone brand.

Technical indicators confirm elevated risk: the domain resolves to IP 82.23.162.216, secured by a Let’s Encrypt SSL certificate, and currently shows 0 detections on VirusTotal (2/95 engines). Registrar and creation date are not disclosed in public WHOIS due to privacy protection, but Google Safe Browsing (GSB) status remains unflagged. It is not listed on major blocklists such as PhishTank or OpenPhish at time of analysis.

Despite low detection coverage, the domain remains active and poses imminent risk of cryptocurrency theft via wallet draining or fake payment portals. Urgent containment is advised: block the domain at DNS and network levels, flag in GSB and enterprise blocklists, and notify affected user populations. Remaining risk is high due to active operation, low AV detection, and branding targeting crypto-savvy users.