pmusd-raac[.]xyz

PhishDestroy identifies pmusd-raac.xyz as an active Ethereum-drainer phishing domain designed to steal cryptocurrency from unsuspecting users by spoofing legitimate services. The domain is currently weaponized with a drainer kit that targets wallet credentials and token approvals, masquerading as a legitimate interface to trick victims into connecting their wallets. No specific brand is being impersonated in the available telemetry, but the site’s structure and payload suggest a generic but highly effective drainer kit optimized for quick fund extraction.

This domain was flagged by PhishDestroy with an elevated risk rating and is blocked by MetaMask and SEAL security layers. Technical indicators include a VirusTotal detection score of 6/95 security vendors, registration through NameSilo, LLC, and resolution to IP address 188.114.96.3. The domain was created on April 03, 2026, and currently resides on 2 active security blocklists. The use of a Let’s Encrypt SSL certificate adds a false sense of legitimacy, while the recent creation date indicates an opportunistic campaign likely timed to exploit current market conditions or user behavior trends.

As of the latest scan, pmusd-raac.xyz remains active and poses a persistent threat to cryptocurrency users. Immediate response actions include network-wide blocking at the DNS and firewall levels, and user advisories to revoke any wallet approvals or connections made to this domain. While the site is currently flagged and mitigated across major security platforms, the risk remains elevated due to the active nature of drainer kits and the potential for domain rotation or rapid infrastructure changes. Users are strongly advised to avoid this domain entirely and monitor their wallet activity for any unauthorized transactions.