primexa[.]cc

PhishDestroy identifies primexa.cc as an active cryptocurrency drainer scam domain designed to steal digital assets through deceptive financial service impersonation. The site mimics legitimate trading or exchange platforms to trick users into connecting cryptocurrency wallets, enabling unauthorized fund transfers via drainer scripts embedded in the interface. This threat type specifically targets Web3 users engaging with DeFi or exchange-like services. This domain was flagged by 6 out of 95 VirusTotal security vendors, indicating a strong but not universal detection consensus. It resolves to IP address 104.21.3.109 and was registered on January 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain holds a valid SSL certificate issued by Google Trust Services, which is commonly exploited in phishing campaigns to appear trustworthy. Additionally, the recent creation date—occurring in early 2026—suggests a hastily deployed threat designed to capitalize on current market or platform trends without long-term infrastructure stability. PhishDestroy assesses the risk level as elevated due to active hosting, drainer functionality, and partial detection coverage. The domain remains online and operational as of this assessment, with no public takedown or blocklist action recorded. Users are strongly advised to block access to 104.21.3.109 and avoid any connection to primexa.cc. If any cryptocurrency-related interaction has occurred, disconnect wallets immediately, revoke any suspicious permissions, and transfer remaining assets to a secure wallet. Remaining risk is high for exposed users and may persist until the domain or associated infrastructure is neutralized.