eraxan[.]com

PhishDestroy analysts have flagged eraxan.com as an active crypto drainer domain designed to siphon cryptocurrency assets from unsuspecting users through fraudulent transaction prompts. The domain impersonates legitimate platforms by leveraging social engineering tactics, luring victims into connecting their wallets and authorizing malicious transactions. This domain presents several red flags in its technical footprint. VirusTotal detection stands at only 1/95 security vendors, highlighting the stealthy nature of the threat. It was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolves to IP address 188.114.96.3, a hosting infrastructure frequently abused for malicious campaigns. The domain was created on February 23, 2026, and secured via a Let’s Encrypt SSL certificate to appear legitimate. While Google Safe Browsing (GSB) status remains unconfirmed, this domain has not yet been widely blacklisted, indicating a potentially emerging threat vector. Given the elevated risk level and active status, immediate defensive actions are advised. Organizations and users should block eraxan.com at the DNS and network levels, inspect any recent wallet interactions involving this domain, and update threat intelligence feeds accordingly. Remaining risk remains high due to delayed vendor detection and low blacklist coverage, necessitating heightened vigilance and proactive monitoring.