ktxp[.]httvd[.]com

PhishDestroy identifies ktxp.httvd.com as an active crypto drainer phishing domain with an elevated risk profile. This domain is engineered to deceive cryptocurrency users by impersonating legitimate platforms or services, with the explicit goal of draining digital assets from unsuspecting victims. The threat actor leverages social engineering tactics, such as fake airdrop campaigns, fraudulent wallet integrations, or spoofed exchange interfaces, to trick users into connecting their wallets or signing malicious transactions. Given the domain’s recent creation, minimal detection coverage, and infrastructure choices, the risk of successful exploitation remains high, particularly in environments where users interact with crypto-related services.

This domain was flagged by PhishDestroy after analysis revealed multiple red flags. VirusTotal reports that 4 out of 95 security vendors have detected malicious activity associated with ktxp.httvd.com, indicating poor detection coverage and a high likelihood of evading automated defenses. The domain resolves to IP address 43.169.25.95, which shows no legitimate association with reputable services and has been linked to previous phishing campaigns. The SSL certificate, issued by Let’s Encrypt, provides a false sense of security by appearing legitimate, while the domain was registered through West263 International Limited—a registrar known for anonymity and abuse tolerance. Notably, ktxp.httvd.com was created on April 02, 2026, suggesting a recent and likely opportunistic campaign. Additional telemetry indicates that the domain has not yet been widely blocked by major threat intelligence platforms, further increasing its potential reach and impact.

To mitigate the threat posed by ktxp.httvd.com, organizations and individual users must take immediate action. Block the domain at the network level using DNS filtering, endpoint protection, or firewall rules to prevent access. Users should avoid interacting with any links, advertisements, or emails referencing this domain, as it may lead to wallet compromise or credential theft. For cryptocurrency users, enable transaction simulation tools or hardware wallet confirmations to detect suspicious outgoing transfers. If the domain is encountered in the context of a crypto-related service, report it to the legitimate platform being impersonated and submit the domain to threat intelligence platforms like VirusTotal for broader dissemination. Finally, ensure all wallet software and browser extensions are updated to the latest versions, as threat actors often exploit outdated software to deliver drainer scripts. Proactive monitoring of blockchain transactions for unauthorized activity is strongly recommended to detect and reverse potential thefts.