notifymyemployees[.]com

PhishDestroy identifies notifymyemployees.com as an active crypto drainer domain impersonating employee notification platforms. This malicious domain is designed to trick users into connecting crypto wallets under the guise of payroll or HR notifications, then silently draining funds via smart contract exploits. While no specific drainer kit fingerprint (e.g., 0x123...abc) was publicly disclosed, the operational pattern aligns with recent campaigns targeting corporate payroll systems.

This domain was flagged by 11/95 VirusTotal security vendors and blocked by PhishingDB. Technical indicators include registration through NAMECHEAP INC on October 05, 2022, resolving to IP 64.238.34.20, and active status on Google Safe Browsing (GSB) with 1 blocklist hit. The domain uses a valid Let’s Encrypt SSL certificate (CN: notifymyemployees.com), likely to appear legitimate. These indicators suggest a low-effort but effective campaign leveraging trusted registrars and SSL to bypass basic detection.

As of the latest scan, notifymyemployees.com remains active with an elevated risk level. PhishDestroy has flagged this domain for immediate action. Users should avoid clicking any links or entering credentials. Organizations are advised to monitor DNS logs for connections to 64.238.34.20 and block the domain at the network perimeter. While response actions have been initiated, the domain’s recent creation date (2022) and sustained VT detection rate indicate ongoing malicious activity. Remaining risk is elevated due to active phishing operations and potential for continued domain rotation.