tge-edel[.]xyz

PhishDestroy identifies tge-edel.xyz as an active fake investment scam targeting cryptocurrency users through a recently registered domain. This site mimics legitimate trading platforms to steal funds or harvest credentials from unsuspecting investors. The threat actor behind this campaign registered the domain on March 30, 2026, and deployed it on IP address 188.114.96.3 using a free Let's Encrypt SSL certificate to appear trustworthy. With only 1 out of 95 security vendors flagging the domain on VirusTotal, this scam evades widespread detection while actively phishing users. This domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently abused by malicious actors for short-lived scam campaigns. The March 30, 2026 creation date indicates this is a recently deployed threat, likely part of a coordinated phishing operation targeting cryptocurrency investors. The low detection rate on VirusTotal suggests limited visibility among security tools, increasing the risk of successful deception. The use of a Let's Encrypt certificate further enhances the scam's credibility by displaying a padlock icon in browsers, luring victims into false confidence. Users who visited tge-edel.xyz should immediately cease any interactions with the site, including wallet connections or login attempts. Scan all connected devices for malware using reputable antivirus software, as scam domains like this often distribute infostealers or remote access trojans. If any credentials or cryptocurrency were entered, revoke API keys, change passwords, and contact your financial institution to report fraud. Block the domain and its IP (188.114.96.3) at the network level to prevent further exposure. Report the scam to your local cybercrime unit and platforms like PhishDestroy to aid in takedown efforts. Stay vigilant against unsolicited investment offers promising unrealistic returns.