paywithcrypts[.]live

PhishDestroy identifies paywithcrypts.live as an active crypto drainer posing as a cryptocurrency payment portal. This domain employs deceptive tactics to trick users into unknowingly authorizing malicious transactions, potentially resulting in irreversible cryptocurrency theft. The infrastructure is currently under active exploitation, with no detections on VirusTotal as of the latest scan, indicating its novelty and evasion techniques.

This domain was flagged with a risk level of 'under_investigation' and has been linked to the following indicators of compromise (IOCs): registered through NameSilo, LLC, secured with a Let's Encrypt SSL certificate, and resolving to IP address 188.114.97.3. The domain was created on May 04, 2026, and currently exhibits 0/95 detections on VirusTotal, suggesting it has not yet been widely recognized or blocked by security vendors. The combination of a recently registered domain, low detection rates, and the specific use of a crypto drainer mechanism heightens the risk of successful exploitation.

To mitigate exposure to this threat, security teams and users are advised to immediately block the domain paywithcrypts.live and its associated IP address 188.114.97.3 at the network level. Additionally, implement strict URL filtering policies to prevent access to this domain and closely monitor network traffic for any connections to this IP. For end users, exercise extreme caution when encountering payment-related prompts, especially those involving cryptocurrency transactions. Verify the legitimacy of payment portals by cross-referencing with official sources and ensure that any transaction interfaces match the expected domain and SSL certificate details. If this domain has been accessed, disconnect from the internet, scan for malware, and consider revoking any cryptocurrency wallet permissions granted to untrusted applications.