compoundcalculator[.]site

PhishDestroy identifies compoundcalculator.site as a generic phishing domain under active investigation for hosting a cryptocurrency drainer kit designed to steal digital assets from unsuspecting users. The domain mimics legitimate financial or calculator tools to deceive visitors into connecting wallets or entering sensitive credentials. No specific brand impersonation has been confirmed at this stage, but the kit’s functionality aligns with common crypto-draining operations that target blockchain transactions and private key exposure.

Technical indicators reveal a freshly registered domain created on April 8, 2026, resolving to IP 188.114.97.3 and leveraging a Google Trust Services SSL certificate. The domain was registered through HOSTINGER operations, UAB, and currently exhibits 0 detections across 95 VirusTotal engines as of the latest scan. Google Safe Browsing (GSB) has not yet flagged the domain, and no blocklist entries were detected in external threat intelligence feeds. These factors suggest either a newly deployed operation or one that has yet to trigger automated detection mechanisms.

The domain remains active with a status of 'under_investigation' as of the latest assessment. PhishDestroy recommends immediate user avoidance and network-level blocking of 188.114.97.3 due to the unconfirmed but high-risk nature of the drainer kit. Organizations should monitor for additional IOCs, including wallet addresses or smart contracts associated with the domain, and update firewall rules or DNS sinkholes accordingly. Remaining risk is classified as high pending further analysis, as the absence of detections does not equate to safety. Users who may have interacted with this domain should revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet.