cyrexmodes[.]to

cyrexmodes.to has been flagged under active investigation for deploying a generic phishing drainer kit purporting to be a legitimate Cyrex Modes cryptocurrency wallet interface. The site mimics familiar crypto-branded UI cues to dupe victims into connecting wallets and signing malicious transactions. Security telemetry confirms an ongoing campaign aimed at cryptocurrency holders seeking discounted software or tooling. cyrexmodes.to was registered through the Government of the Kingdom of Tonga on March 28, 2026. It currently shows a VirusTotal detection ratio of 4 out of 95 engines as of seed 861da0, indicating zero detections despite active phishing behavior. The domain resolves to IP address 185.178.208.138 and operates under a Let's Encrypt SSL certificate, increasing perceived legitimacy. At present, this domain remains unlisted on Google Safe Browsing (GSB) and has not yet accumulated blocklist entries in major threat intelligence feeds, providing it a window of opportunity to attract victims. As of this report, the status of cyrexmodes.to is marked active and under active monitoring. Immediate user action includes blocking the domain at DNS and firewall levels, flagging the associated IP in network rules, and alerting cryptocurrency communities via trusted channels. Remaining risk remains HIGH due to zero AV detections and absence from public blocklists, meaning an expanding victim base is highly likely. Users are advised to avoid clicking links or downloading executables from this domain and to verify software sources through official channels only.