andafbit[.]cc

PhishDestroy identifies andafbit.cc as an active crypto drainer domain used in phishing campaigns targeting cryptocurrency users. The domain mimics legitimate crypto service interfaces to trick victims into connecting their wallets and authorizing malicious token transfers. No specific drainer kit was identified in public sources, but the site’s behavior aligns with common web3 drainer scripts that exploit wallet signature requests to drain funds from connected wallets.

andafbit.cc was registered on April 26, 2026 through Gname.com Pte. Ltd. and resolves to IP address 188.114.96.3. According to VirusTotal, 5 out of 95 security vendors have flagged this domain as malicious, and it is blocked by ScamSniffer. The domain is currently listed on 1 public security blocklist and uses a Let’s Encrypt SSL certificate. These technical indicators confirm a high level of malicious intent and operational maturity.

As of the latest scan, andafbit.cc remains active and accessible, posing an elevated risk to users who may encounter it through phishing emails, fake ads, or social media impersonation campaigns. Immediate defensive actions include domain blocking via DNS filters and browser-based blocklists. Users are strongly advised to avoid connecting wallets or entering any credentials on this domain. While current detection coverage is moderate, the domain’s recency and rapid deployment suggest it may evade some security tools. Ongoing monitoring and user awareness remain critical to prevent successful drainer attacks.