odoscommunity[.]xyz

PhishDestroy identifies odoscommunity.xyz as a newly active crypto drainer phishing domain registered on January 24, 2026. The site impersonates Odos—a legitimate decentralized exchange—to trick users into connecting wallets and approving malicious token transfers. Historical telemetry suggests the threat actor is deploying a drainer kit similar to those seen in past DeFi phishing campaigns targeting EVM chains. Intelligence indicates this domain was provisioned for credential theft through fake wallet connection prompts rather than traditional web credential harvesting. This domain was flagged by PhishDestroy with 2/95 VirusTotal detections as of the latest scan, indicating the threat remains undetected by mainstream scanners. Registration was processed through NICENIC INTERNATIONAL GROUP CO., LIMITED, with infrastructure resolving to IP 188.114.96.3. The site holds a valid SSL certificate issued by Google Trust Services, complicating browser-based detection. Domain creation date (January 24, 2026) suggests a very recent launch, likely in response to Odos’s growing user base. Despite zero VirusTotal detections, the domain has not yet been added to Google Safe Browsing or major threat intelligence blocklists, indicating an early-stage campaign. At this time, odoscommunity.xyz remains active and is not widely blocked, creating elevated risk for users interacting with DeFi platforms and crypto wallets. PhishDestroy has flagged this domain for takedown and has shared Indicators of Compromise (IOCs) with major browser vendors and threat intelligence platforms. Users are strongly advised to avoid clicking links from unsolicited messages and to verify site URLs manually. Until full deactivation, this domain should be treated as a high-risk crypto drainer phishing site. Blocking the domain at the network level and monitoring for similar impersonation attempts is recommended to prevent credential theft and fund loss.