api[.]2025baodan-666[.]xyz

PhishDestroy identifies active cryptocurrency drainer campaign using domain api.2025baodan-666.xyz, impersonating a '2025 Tax Refund' portal. The infrastructure is currently live and distributing malicious payloads. This campaign actively targets cryptocurrency holders under the guise of tax refund processing, with domain components suggesting urgency around Chinese tax reporting ('baodan' translates to 'tax filing').

This domain was flagged by 0 of 95 VirusTotal vendors, indicating current evasion of signature-based detection systems. Registered through Go Daddy, LLC, the domain resolves to IP 104.21.14.86 (Cloudflare infrastructure) and was created on March 19, 2026. No current blocklist inclusions were detected at time of analysis, and the SSL certificate is issued by Let's Encrypt (indicating valid HTTPS but not legitimacy). Technical indicators include the use of API subdomain structure to mimic legitimate tax service authentication portals, a common tactic in crypto drainer campaigns.

The campaign remains active as per Threat Intelligence seed 9931a5. Users should immediately block this domain at DNS and network levels. All cryptocurrency transaction requests from this domain must be considered malicious. Verify legitimacy of tax-related domains through official government channels or PhishDestroy verification tools. Never enter wallet credentials or seed phrases into web forms linked from unsolicited emails or advertisements. Report any interaction with this domain to PhishDestroy for further analysis and inclusion in threat feeds.