lovemos[.]biz

PhishDestroy classifies lovemos.biz (registered 17 Oct 2023) as a generic phishing domain hosting a crypto drainer kit that mimics a legitimate login interface. The campaign targets cryptocurrency users by presenting a spoofed wallet or exchange portal designed to harvest private keys or seed phrases. The site leverages deceptive styling and urgency cues to trick visitors into entering credentials or connecting a wallet, after which assets are drained to attacker-controlled addresses. Comparable indicators have not yet been mapped to a single drainer kit; therefore the exact kit variant remains undetermined in open sources.

This domain resolves to IP 91.206.71.16 and is hosted behind a Google Trust Services SSL certificate, which may enhance its perceived legitimacy. VirusTotal shows only 1 out of 95 security vendors flagging the URL as malicious as of the latest scan, underscoring how new, niche, or low-signal detections can miss emerging phishing infrastructure. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and appears to be recently created, with creation dates shortly before the observed phishing activity. The low blocklist count and fresh registration window suggest this is an early-stage campaign with limited exposure to global blocklists.

As of the latest intelligence feed, lovemos.biz remains active and categorized as elevated risk. PhishDestroy continues to monitor the domain and has added it to the internal blocklist to prevent further access. Users are advised to avoid visiting the site and to verify any similar-looking URLs using the PhishDestroy database before entering sensitive information. Despite SSL and low vendor detection, the combination of fresh registration, crypto-focused lure, and elevated risk rating warrants caution. The residual risk remains material until the domain is sinkholed or universally blocked by major browsers and security platforms.