aaktivsipylaterindon[.]prestocu[.]biz[.]id

PhishDestroy identifies the active domain aaktivsipylaterindon.prestocu.biz.id as a crypto-draining phishing host designed to siphon cryptocurrency from unwary users. This site masquerades as a legitimate service to trick victims into connecting wallet browser extensions, where a malicious payload silently drains tokens on-chain. All wallet connections initiated through this domain should be treated as compromised; users must revoke any permissions immediately after leaving the page. This domain was flagged by PhishDestroy’s generic-phishing pipeline and remains under active investigation. The site resolves to IP 188.114.97.3 and is served over a Let’s Encrypt SSL certificate. VirusTotal currently shows zero detections (20/95 engines) and the domain was created recently with no long-term reputation to rely on. Registrar records point to a bulk-registration provider suggesting low operational cost and rapid turnover typical of drainer campaigns. If you visited aaktivsipylaterindon.prestocu.biz.id, disconnect your wallet immediately, revoke all permissions via tools like revoke.cash or Rabby’s permission manager, and scan your device with Malwarebytes or Windows Defender. Report the incident to PhishDestroy using seed 7bd556 so the IP and certificate can be blocked network-wide.