rd[.]fundyalbert[.]com

PhishDestroy identifies rd.fundyalbert.com as an active crypto drainer posing under ongoing investigation. This domain is engineered to trick cryptocurrency users into connecting wallets or entering seed phrases, enabling direct fund extraction. The infrastructure leverages deceptive naming that mimics legitimate Albert-related services, likely targeting users searching for financial tools or promotions. Security teams should treat this as a high-risk endpoint due to its active status and intent to defraud crypto holders.

This domain was registered through TUCOWS.COM, CO. on May 16, 2022, and currently resolves to IP 185.149.120.183. Its SSL certificate is issued by Let’s Encrypt, a common tactic to appear legitimate. Notably, VirusTotal currently shows 8 out of 95 detection engines flagging this domain, suggesting low static detection coverage despite its malicious purpose. The absence of alerts does not imply safety—this is a known evasion strategy used by crypto-draining campaigns to bypass early-stage filtering.

Users who visited rd.fundyalbert.com should immediately disconnect any connected wallets, revoke any granted permissions via blockchain explorers or wallet interfaces, and scan their devices for malware. Do not enter any credentials, private keys, or seed phrases. Report the domain to your security team and block it at the network firewall. If funds were stolen, file a report with local law enforcement and your wallet provider. Monitor accounts for unauthorized transactions and consider rotating keys if compromised.