gro77z-fxempire[.]com

PhishDestroy identifies gro77z-fxempire.com as an active crypto drainer site impersonating the FXEmpire brand, designed to steal cryptocurrency through fraudulent transactions. The domain employs a deceptive interface mimicking legitimate financial platforms to trick users into connecting crypto wallets and approving malicious transactions. Technical analysis confirms the presence of a drainer kit embedded in the website’s JavaScript, which automatically siphons approved funds upon wallet signature. This domain represents a direct threat to cryptocurrency investors and users of financial trading platforms. This domain was flagged on April 14, 2026, just hours after creation, indicating a fast-acting threat actor leveraging newly registered infrastructure. It resolves to IP address 104.21.87.32 and utilizes a legitimate Let’s Encrypt SSL certificate to appear trustworthy. The domain is registered through Ultahost, Inc., a hosting provider often exploited by malicious actors due to lax abuse monitoring. VirusTotal reports a low 1/95 detection rate as of seed 969a50, highlighting the challenge of early-stage threat identification. The domain is currently unlisted on Google Safe Browsing (GSB) and has not yet propagated widely across major threat intelligence feeds, increasing its potential reach. As of this report, gro77z-fxempire.com remains active and poses an elevated risk to visitors. Users who have interacted with this site are advised to revoke any wallet connections immediately and transfer remaining assets to a secure, hardware-backed wallet. All crypto drainer domains should be blocked at the network and DNS levels. This domain is expected to persist until reported to hosting providers and registrars for takedown. The remaining risk is high due to the domain’s recent registration, low detection rate, and lack of widespread blocking. Immediate action is required to prevent further victimization.