apylink[.]com

PhishDestroy identifies apylink.com as an active generic phishing domain leveraging a crypto wallet drainer kit to steal cryptocurrency assets. The domain was registered on August 22, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 172.67.137.222. The domain is protected by a Google Trust Services SSL certificate, potentially enhancing its credibility to unsuspecting victims. No current detections on VirusTotal, indicating this campaign is either newly deployed or actively evading detection mechanisms.

Technical indicators for apylink.com include a VirusTotal detection score of 0/95, no presence on Google Safe Browsing (GSB), and no known inclusion on blocklists at the time of analysis. The domain’s recent creation date and lack of historical detections suggest a deliberate effort to operate under the radar. The registrar’s association with high-risk domains and the absence of prior security flags further elevate the risk profile of this domain.

This domain remains active and unblocked, posing a significant risk to cryptocurrency users. Immediate actions include blocking the domain at the network level and updating endpoint security rules to flag the IP (172.67.137.222) and domain (apylink.com). Users are advised to avoid interacting with unsolicited links or websites promoting crypto wallet services. The remaining risk is classified as under investigation due to the lack of historical intelligence, but the combination of recent registration, drainer kit deployment, and zero detections warrants urgent defensive measures.