app-soporte-online[.]com

PhishDestroy identifies app-soporte-online.com as a live crypto drainer page that mimics legitimate tech-support portals to trick users into connecting wallets and signing malicious transactions. The domain hosts a spoofed support interface designed to harvest credentials and drain crypto assets under the guise of troubleshooting. No specific brand impersonation has been confirmed, but the page structure closely resembles common support scams leveraging urgency and fake error messages. This domain exhibits clear red flags: VirusTotal shows only 1 out of 95 security vendors detecting the threat (1/95), indicating near-zero detection despite active abuse. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 28, 2026, it resolves to IP 172.67.203.245 and holds a valid Let’s Encrypt SSL certificate to appear trustworthy. Google Safe Browsing (GSB) currently lists it as clean, and public blocklists show zero prior detections, highlighting its recent emergence and low reputation. As of this assessment, the domain remains active and unblocked by major browsers or security suites. Immediate actions include domain takedown requests, IP de-listing, and GSB flagging. While the current risk is elevated due to active deployment, users can mitigate exposure by avoiding unsolicited support links and verifying sites via PhishDestroy. Remaining risk persists until widespread blocking and vendor detection updates are implemented.