spax24k[.]com

PhishDestroy identifies spax24k.com as an active domain associated with a generic cryptocurrency drainer campaign. The domain is currently under investigation due to its suspicious operational patterns and lack of detection by traditional security vendors. Initial analysis suggests the threat actor may be leveraging the domain for credential harvesting or wallet draining, though the exact impersonation target remains unverified at this stage.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite potentially malicious activity. It was registered via NameSilo, LLC, and resolves to IP address 188.114.97.3. The domain was created on April 22, 2026, and utilizes a Let's Encrypt SSL certificate for added legitimacy. Trust scores and blocklist counts remain unavailable due to its recent emergence, warranting heightened monitoring.

Given the active status and potential risk to cryptocurrency users, PhishDestroy recommends immediate blocking of spax24k.com at the network and endpoint levels. Users who may have interacted with the domain should verify their wallet security and revoke any unauthorized permissions. Continuous monitoring of associated infrastructure (IPs, ASNs, or related domains) is advised to prevent further exploitation.