invoice-cbase[.]com

PhishDestroy identifies the active crypto drainer domain invoice-cbase.com as an elevated-risk threat currently circulating in the wild. This domain is engineered to deceive cryptocurrency users into authorizing fraudulent transactions that silently drain digital wallets of tokens and NFTs. The infrastructure is operational and remains accessible to potential victims.

This domain was flagged by 8 of 95 VirusTotal security vendors, registered through HOSTINGER operations, UAB, and resolves to IP address 72.62.60.227. The domain was created on April 30, 2026, and currently holds a low trust score across multiple threat intelligence platforms. It utilizes a valid SSL certificate issued by Let's Encrypt to enhance its appearance of legitimacy, a common tactic among crypto drainer campaigns to bypass browser warnings.

Given the elevated risk level and active status, users are strongly advised to block invoice-cbase.com at the network level and avoid any interaction with links or attachments associated with this domain. Organizations should update firewall rules, email filters, and endpoint protection platforms to detect and block traffic to 72.62.60.227. Always verify transaction requests via out-of-band communication channels and use hardware wallets with transaction approval screens to prevent unauthorized transfers. Monitor wallet addresses for unauthorized activity and report any suspicious transactions immediately to relevant authorities.