nebugex[.]com

PhishDestroy identifies nebugex.com as a recently activated crypto drainer domain designed to harvest credentials from unsuspecting investors. The domain is currently deployed in the wild but remains under active investigation by threat intelligence teams. Analysis indicates it leverages deceptive login portals to trick victims into surrendering sensitive wallet keys or exchange credentials, with infrastructure optimized for rapid credential theft and fund exfiltration. Initial telemetry suggests a focus on cryptocurrency users, leveraging urgency and fear-based lures to prompt hasty actions. This domain was registered on April 08, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar known for anonymizing registrant data and facilitating short-lived malicious campaigns. The domain resolves to IP address 176.124.206.61 and utilizes a Let's Encrypt SSL certificate to enhance legitimacy. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating it has not yet been widely blacklisted or flagged by automated detection systems. Google Safe Browsing (GSB) has not yet classified the domain as malicious, and no public blocklist entries were found during initial reconnaissance. The domain's age and clean reputation profile suggest it is in an early operational phase, possibly still under development or calibration prior to wider deployment. Currently, the domain remains active and accessible, with no active takedown or mitigation actions observed in public channels. Given the absence of detections and the domain's recent creation, the risk level is marked as 'under_investigation' to reflect uncertainty in long-term behavior. Immediate user action is advised: avoid interacting with nebugex.com, verify any similar domains through PhishDestroy’s validation tools, and report encounters to security teams for further correlation. Remaining risk depends on the domain’s evolution—should it be weaponized at scale or integrated with known drainer kits, the threat level could escalate rapidly. Users are urged to treat all unsolicited crypto-related login prompts with extreme caution and validate domains independently before proceeding.