gro90p-fxempire[.]com

PhishDestroy identifies gro90p-fxempire.com as a high-risk crypto drainer domain currently active in phishing campaigns targeting cryptocurrency users. This domain mimics legitimate financial platforms to trick victims into connecting wallets and signing malicious transactions that drain digital assets. Security researchers have observed similar domains exploiting brand impersonation tactics, leveraging urgency and financial incentives to bypass user skepticism. The domain’s infrastructure is designed to facilitate unauthorized cryptocurrency transfers once victims engage with embedded drainer scripts, making it a critical threat to digital asset holders. This domain was flagged with 6 out of 95 VirusTotal detections, indicating it has evaded initial automated detection systems despite its malicious intent. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026, the domain resolves to IP address 188.114.97.3 and holds a valid Let’s Encrypt SSL certificate, which may lend false credibility to unsuspecting users. The combination of a newly registered domain, low detection rates, and active infrastructure suggests this may be part of a larger, evolving phishing campaign targeting crypto investors. Users who visited gro90p-fxempire.com should immediately disconnect any connected cryptocurrency wallets and revoke any permissions granted to unknown domains or applications. Scan devices for malware using reputable antivirus tools and monitor wallet transactions for unauthorized activity. Report the domain to your security team or relevant cybercrime authorities to aid in takedown efforts. Avoid interacting with any prompts or transactions on this site, as it is actively engaged in crypto drainer operations.