member-labubu-dev[.]underconstruction[.]work

PhishDestroy identifies member-labubu-dev.underconstruction.work as an active generic phishing domain deployed under the guise of the Labubu NFT ecosystem. The infrastructure masquerades as a development portal (member-labubu-dev) hosted on the underconstruction.work subdomain, a pattern commonly abused by threat actors to distribute drainer scripts targeting cryptocurrency wallets. While no established drainer kit signature (e.g., AngelDrainer, InfernoDrainer) has been confirmed, the domain’s naming convention and path structure strongly suggest deployment within a broader phishing campaign aimed at NFT communities.

This domain exhibits multiple indicators of malicious intent. It resolves to IP 47.57.184.185 and was registered via GoDaddy.com, LLC on May 02, 2019. A Let's Encrypt SSL certificate is active, likely to enhance legitimacy. As of the latest scan, VirusTotal reports 3/95 detections, indicating evasion against current AV/IOC signatures. The domain remains unlisted in Google Safe Browsing (GSB) and has not been flagged by major threat intelligence platforms, suggesting it is in an early operational phase. These characteristics—low detection rate, recent or dormant creation date, and absence from blocklists—are typical of newly activated phishing infrastructure designed for rapid exploitation before mitigation.

The campaign remains ACTIVE, with no confirmed takedown or blocklisting at this stage. PhishDestroy assesses the risk as UNDER INVESTIGATION due to the lack of historical intelligence and the domain's low detection footprint. Users are strongly advised to avoid visiting member-labubu-dev.underconstruction.work and verify any Labubu-related links through official channels. Security teams should monitor 47.57.184.185 and the domain's SSL certificate fingerprint for further malicious activity. Immediate blocking of the domain and IP is recommended to prevent wallet compromise and data exfiltration.