wcasx[.]cc

PhishDestroy identifies wcasx.cc as an active crypto drainer domain currently under investigation for malicious redirection intended to steal cryptocurrency assets. The domain exhibits characteristics consistent with phishing infrastructure designed to impersonate legitimate services and intercept wallet credentials or private keys. Current status is classified as active with a risk level of 'under_investigation,' indicating ongoing behavioral analysis and mitigation efforts. This domain was flagged by 4 out of 95 VirusTotal security vendors as of seed 196304, placing it in a low-detection window that highlights the importance of proactive domain scrutiny. Wcasx.cc was registered through Global Domain Group LLC on April 20, 2026, and resolves to IP address 104.21.6.24. The domain utilizes a Let’s Encrypt SSL certificate to appear legitimate and evade browser warnings. Despite zero immediate detections, the combination of recent registration, low trust indicators, and alignment with known crypto-draining infrastructure elevates the threat profile. Historical analysis shows minimal presence on public blocklists, with no current entries in major threat intelligence feeds. At this time, wcasx.cc remains in a provisional state of monitoring due to insufficient evidence of active compromise but exhibits multiple red flags consistent with emerging phishing operations. Users are strongly advised to avoid interacting with the domain, including accessing any linked pages or entering credentials. PhishDestroy recommends blocking IP 104.21.6.24 at the network perimeter and monitoring outbound connections to this address. Businesses should update endpoint detection rules to flag wcasx.cc and its resolving IP as indicators of compromise. Continuous monitoring for new detections is essential, as threat actors frequently shift infrastructure to avoid detection.