babyfloki[.]click

PhishDestroy identifies babyfloki.click as a generic phishing domain currently hosting a crypto-drainer kit. The site does not impersonate a specific brand but instead uses a meme-coin-themed lure (Baby Floki) to trick users into connecting crypto wallets and signing malicious transactions that drain funds. No custom branding is present; the page relies on social-engineering narratives around the Baby Floki meme to lower user suspicion. babyfloki.click resolves to 188.114.96.3 and was registered through TUCOWS.COM, CO. on October 13, 2025—making it only days old. The domain holds a valid SSL certificate issued by Google Trust Services, a tactic often used to lend false legitimacy. VirusTotal currently shows 2 out of 95 engines flagging the page, indicating it has slipped through initial detection layers. Because the registrar and IP space have hosted other low-sophistication scams in the past 90 days, the domain’s reputation is poor despite its fresh SSL issuance. The site remains actively accessible as of today and is not yet blocked by Google Safe Browsing (GSB). At this stage, the threat is classified as under investigation with an elevated risk profile due to the rapid deployment of drainer kits on newly registered domains. Users should verify any link against PhishDestroy’s live blocklist before interaction; organizations are advised to add 188.114.96.3 and babyfloki.click to firewall and DNS blocklists immediately. Until detection coverage improves, the residual risk of successful fund theft remains moderate.