amptox29[.]xyz

PhishDestroy identifies amptox29.xyz as an active crypto drainer phishing domain currently under investigation. The domain specifically targets cryptocurrency users by mimicking legitimate platforms to siphon funds through deceptive transactions. Security teams have confirmed the threat actor’s infrastructure remains operational, warranting heightened vigilance for associated domains and IPs. This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating its recent emergence and low detection coverage. It resolves to IP 35.213.153.38, registered through Dynadot LLC on April 22, 2026. Notably, it utilizes a Let’s Encrypt SSL certificate, which may lend false legitimacy to potential victims. The domain’s age and lack of blocklist entries (0 detections) suggest it is a fresh campaign, likely leveraging newly registered infrastructure to evade early-stage defenses. As the investigation progresses, users are strongly advised to avoid interacting with amptox29.xyz or any subdomains/resolving IPs. Organizations should implement network-level blocks for the offending IP (35.213.153.38) and monitor for DNS resolutions to this domain. Cryptocurrency platforms must enhance user education regarding crypto drainer tactics, emphasizing verification of transaction URLs via trusted sources like PhishDestroy. Security teams are urged to treat this domain as a high-priority indicator of compromise (IOC) and share telemetry to accelerate mitigation efforts.