ampleeparature-fr[.]live

PhishDestroy identifies ampleeparature-fr.live as a live crypto drainer phishing domain. This domain is actively engaged in fraudulent activities designed to deceive users into connecting wallets and draining cryptocurrency assets without consent. The campaign is currently operational and poses a direct financial risk to unsuspecting victims. All indicators suggest the threat actor is leveraging deceptive domain naming and SSL encryption to enhance credibility and evade detection mechanisms.

This domain was flagged by 3 of 95 VirusTotal vendors as of the latest scan, indicating it remains undetected by most security solutions. It resolves to IP address 172.67.174.98 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created on May 07, 2026, and employs a valid Let's Encrypt SSL certificate to mimic legitimate websites. Despite zero detections, the absence of blocklist entries cannot be interpreted as safety, given the evolving nature of such campaigns. Trust scores across threat intelligence platforms remain critically low, emphasizing the need for proactive intervention.

The current status of ampleeparature-fr.live is active and under investigation. Users and organizations are strongly advised to block this domain at the network and DNS levels immediately. Implement strict URL filtering policies to prevent access and deploy endpoint detection rules targeting crypto-related fraud indicators. Security teams should monitor for related infrastructure and update threat intelligence feeds in real time. Immediate reporting to relevant CERT teams and domain registrars (via abuse channels) is strongly recommended to facilitate takedown efforts. Exercise heightened caution with any site or wallet connection solicited via unsolicited communications.