psxloot[.]net

PhishDestroy identifies psxloot.net as an active fake login phishing domain impersonating a generic service. The domain was registered on April 02, 2026, through Global Domain Group LLC and resolves to IP 209.112.89.200. This site employs a crypto drainer kit designed to harvest credentials and session tokens, posing a direct threat to user accounts. The lack of detections (1/95 on VirusTotal) indicates it remains undetected by mainstream security vendors, increasing the risk of successful exploitation. This domain exhibits multiple red flags consistent with malicious infrastructure. VirusTotal currently shows 1/95 detection engines flagging the domain, suggesting it has evaded initial scrutiny. The domain was registered via Global Domain Group LLC and utilizes a Let’s Encrypt SSL certificate to appear legitimate. The IP address 209.112.89.200 is associated with hosting providers known for accommodating malicious activity. Additionally, the domain’s recent creation date (April 02, 2026) indicates it is part of a fast-flux or newly deployed campaign, likely targeting unsuspecting users within hours of its launch. The absence of entries in Google Safe Browsing (GSB) and other blocklists further exposes users to potential compromise. As of this report, psxloot.net remains active and under investigation by PhishDestroy’s threat intelligence team. Immediate actions include continued monitoring, domain takedown requests, and IP-based blocking by network defenders. However, the low detection rate and recent registration timeline suggest that this threat may persist for hours or days before widespread recognition occurs. Users are strongly advised to verify any interaction with this domain using PhishDestroy’s tools and to avoid entering credentials or sensitive information. The remaining risk is classified as high due to the domain’s evasion techniques and the potential for rapid dissemination in phishing campaigns.