alphalocetes[.]com

PhishDestroy identifies alphalocetes.com as an active crypto drainer phishing domain leveraging impersonation tactics. The domain mimics legitimate entities to trick users into connecting crypto wallets and authorizing malicious token transfers. No specific brand impersonation was confirmed in current IOCs, though generic financial service spoofing is strongly suspected based on site content structure and social engineering vectors observed in related campaigns.

This domain presents multiple confirmed technical indicators of compromise. VirusTotal reports an 11/95 detection score (accessed seed 96e63b), while Google Safe Browsing has flagged it under SOCIAL_ENGINEERING. Registered through NAMECHEAP INC on January 12, 2026, the domain resolves to IP 185.9.24.215 using a Let’s Encrypt SSL certificate. It appears on three separate security blocklists including OpenPhish, PhishingArmy, and InversionDNS.

As of current analysis, alphalocetes.com remains active and poses a high-risk threat to unsuspecting users. PhishDestroy’s automated pipeline has integrated this IOC into real-time detection feeds, and the domain is actively blocked across multiple enterprise and consumer security platforms. However, due to the recent domain registration and evolving infrastructure patterns, users should exercise extreme caution when encountering any financial or login-related prompts involving this domain. Continuous monitoring and user awareness remain critical to mitigating exposure to this campaign.