fjcultra[.]pics

PhishDestroy identifies an active crypto-draining campaign hosted at fjcultra.pics that lures victims with a fake page titled “Duck Detective: Ghost Glamping.” The site mimics a game interface to trick users into connecting wallets and signing malicious transactions that silently drain cryptocurrency assets. Security analysts note that the page uses social-engineering tactics centered on “ghost glamping” lore to create urgency and curiosity, pushing unwary users toward wallet connection prompts. This is not a generic login portal; it is a purpose-built drainer designed to authorize token transfers without the victim’s explicit awareness. This domain was flagged on January 22, 2026—just days ago—by PhishDestroy’s automated crawlers before VirusTotal flagged it, showing 0 detections out of 95 scanners as of the last scan. The domain is registered through Dynadot LLC and resolves to IP address 188.114.97.3, which is co-located with other recently observed crypto-draining infrastructure. Despite serving an HTTPS page backed by a Google Trust Services certificate, the content itself is malicious, and the certificate does not attest to legitimacy. The rapid launch and zero initial detections underscore the evasiveness of this threat, which deliberately avoids detection until after funds have been moved. If you visited fjcultra.pics, immediately revoke any wallet connections via your wallet’s “Connected Apps” or “DApp Browser” settings and do not sign further transactions from that device. Disconnect the site from your wallet, clear browser cache and cookies related to the domain, and run a reputable antivirus scan. Report the domain to PhishDestroy for takedown and consider rotating private keys or using a hardware wallet for future transactions until the campaign is neutralized. Time is critical—crypto drainers often execute transfers within minutes of signature approval.