denevex[.]com

PhishDestroy identifies denevex.com as an active generic phishing domain deployed as a cryptocurrency drainer kit designed to siphon digital assets from unsuspecting victims. The domain shows no overt brand impersonation in current telemetry, suggesting opportunistic targeting rather than a focused campaign against a specific service or corporation. The threat actor utilizes a lightweight drainer script injected into benign-looking landing pages, automatically transferring approved token allowances to attacker-controlled wallets upon user wallet connection. Domain registration artifacts and hosting patterns align with bulletproof infrastructure typically leveraged by lower-tier drainer-as-a-service operators seeking quick monetization without the overhead of elaborate social engineering. This domain was flagged by PhishDestroy on April 06 2026 with the unique seed aa2f8c and is currently categorized under the generic phishing threat type. VirusTotal detection stands at exactly 1 out of 95 participating security vendors as of the same date. The domain resolves to a single IPv4 address: 172.67.208.145, hosted within Cloudflare’s infrastructure. The domain was registered on April 05 2026 through the registrar Fewmoretaps OU, operating under the trade name Trustname.com. The SSL certificate protecting the phishing endpoint was issued by Let’s Encrypt, indicating the threat actor prioritized low-cost encryption to appear legitimate. Google Safe Browsing has not yet issued a blocklist verdict for this domain, and as of this report, no public blocklists include denevex.com. The extremely low VT score reflects the novelty of the domain and the limited exposure to signature-based detection mechanisms. As of April 06 2026, denevex.com remains active and operational, with no observed takedown or mitigation by hosting providers or registrars. PhishDestroy has issued an elevated-risk classification and continues to monitor traffic patterns and wallet interactions in real time. Users and security teams are advised to block denevex.com at the network perimeter and avoid any interactions with the domain. The combination of recent registration, low detection coverage, and active drainer deployment contributes to an elevated risk profile that may escalate if the domain gains traction among threat actors or becomes associated with a higher-profile impersonation campaign. Regular scanning through PhishDestroy is recommended to detect any shifts in threat sophistication or infrastructure changes.