labubusol[.]space

PhishDestroy has identified www.labubusol.space as a generic phishing domain targeting cryptocurrency enthusiasts through a fraudulent BUBU Coin Presale. The site has been taken offline, but users should remain vigilant as similar threats may re-emerge. This domain was not impersonating a specific brand but rather created a fake presale event to trick victims into connecting their wallets or sending funds.

Technical analysis reveals that the domain resolves to IP address 64.29.17.65 and was registered through HOSTINGER operations, UAB, a common registrar for malicious domains. The domain was created on May 28, 2025, and its SSL certificate was issued by Let's Encrypt (R12), which provides free certificates and is frequently abused by phishers. VirusTotal flags it with 4 out of 95 security vendors detecting malicious activity, and it appears on 1 security blocklist. These indicators, combined with the presale theme, strongly suggest it was a crypto drainer designed to steal funds or credentials.

As the site is now offline, the immediate risk is reduced, but PhishDestroy advises users to avoid interacting with any unsolicited presale offers. Always verify the legitimacy of cryptocurrency projects through official channels. If you have already interacted with this domain, immediately revoke any token approvals and change your passwords. For ongoing protection, use PhishDestroy's browser extension to detect similar threats and report any suspicious domains to cybersecurity authorities.