canna272i7uai6h5ctkrrfttwv2naulak37gctk22t6erohxegtu45yd[.]top

PhishDestroy identifies the domain canna272i7uai6h5ctkrrfttwv2naulak37gctk22t6erohxegtu45yd.top as a generic phishing page impersonating CannaExpress with a fake 'Access Queue' login portal. This domain employs a crypto drainer kit designed to harvest wallet credentials and initiate unauthorized transactions upon authentication. The page mimics a legitimate cannabis e-commerce queue system, tricking users into entering sensitive wallet information under the guise of order processing. This domain resolves to IP 172.67.143.85 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 04, 2026. VirusTotal currently reports 2 out of 95 detections, indicating it remains undetected by most antivirus engines. The domain holds a valid SSL certificate issued by Google Trust Services, which may further deceive users into believing the site is legitimate. As of this report, it has not been flagged by major blocklists such as Google Safe Browsing. The domain remains active and poses an ongoing risk due to its low detection profile and deceptive branding. PhishDestroy has flagged this as a high-priority threat requiring immediate user awareness and verification. Users are advised to avoid interacting with this domain and to report any suspicious activity. Remaining risk includes the potential for additional phishing pages or drainer variants to emerge under similar naming conventions. Immediate action includes domain takedown requests and updating browser blocklists to prevent further exploitation.