maga-eth[.]icu

PhishDestroy identifies maga-eth.icu as an active Ethereum drainer kit domain designed to deceive cryptocurrency users into connecting their wallets for asset theft. This domain was flagged under generic_phishing with a current risk level marked as under_investigation. The infrastructure leverages a Let's Encrypt SSL certificate to appear legitimate while resolving to IP 188.114.97.3, a hosting address associated with malicious crypto operations. The domain mimics legitimate Ethereum-related services to trick users into authorizing fraudulent transactions or signing malicious messages that drain wallet balances.

This domain presents the following EXACT technical indicators: VirusTotal detection score of 2/95, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, hosted on IP 188.114.97.3, and created on April 29, 2026. As of the latest analysis, this domain has not been flagged by Google Safe Browsing (GSB) and remains unlisted on major blocklists, allowing it to operate undetected by automated security systems. The absence of detections suggests a newly deployed threat with potential for rapid expansion as the operators refine their tactics.

The current status of maga-eth.icu is active, with the domain actively serving its drainer kit payload to unsuspecting visitors. Response actions include ongoing monitoring by PhishDestroy and coordination with hosting providers to mitigate the threat. However, the remaining risk remains significant due to the domain's recent creation, lack of detection signatures, and use of trusted SSL certificates. Users are strongly advised to avoid interacting with this domain, verify all Ethereum-related URLs before connecting wallets, and report any suspicious activity to their security teams or PhishDestroy for immediate takedown requests. Immediate blocking of IP 188.114.97.3 and the domain maga-eth.icu is recommended to prevent further exploitation.