ca[.]gov-zxq[.]info

PhishDestroy identifies ca.gov-zxq.info as an active generic phishing domain impersonating the official California state government portal. The domain hosts a crypto drainer kit designed to steal cryptocurrency funds from unsuspecting users by mimicking legitimate state services. Victims are lured via spoofed emails or social media links, where the fraudulent site prompts wallet connections under false pretenses. This domain exhibits multiple red flags detailed in forensic analysis. As of the latest intelligence, ca.gov-zxq.info shows a VirusTotal detection score of 16 out of 95 security vendors, indicating significant malicious activity. The domain was registered with an obscure registrar and resolves to IP address 43.165.68.78. Notably, Google Safe Browsing flags this domain under the SOCIAL_ENGINEERING category, a clear indicator of deceptive practices. Further, it appears on two security blocklists including OpenPhish and PhishingArmy, reinforcing its malicious nature. As of current assessment, ca.gov-zxq.info remains active and poses a high risk to visitors. Immediate actions include blocking the domain at the network level and updating threat intelligence feeds to prevent access. While response efforts have mitigated some exposure, the domain's use of a Let's Encrypt SSL certificate and active hosting infrastructure means the risk of victimization persists. Users are strongly advised to verify domains through trusted sources like PhishDestroy before interaction. This domain exemplifies the evolving tactics of crypto scammers leveraging government impersonation to exploit public trust.