aztecsun[.]vip

PhishDestroy identifies aztecsun.vip as a recently activated crypto drainer domain designed to impersonate legitimate crypto airdrop campaigns, tricking users into connecting wallets and approving malicious token transfers. This domain was flagged with the unique seed 424862 and remains under investigation as it begins propagating through phishing campaigns. Technical indicators confirm high-risk attributes: the domain was created on December 05, 2025 (indicating a very recent campaign), resolving to IP 172.67.140.91, and registered via Dynadot Inc. The SSL certificate is issued by Google Trust Services, adding a false veneer of legitimacy. Critically, VirusTotal currently shows 1/95 detections, meaning it evades most antivirus engines—making it especially dangerous for unaware users. The domain employs a deceptive naming scheme mimicking “Aztec” protocol branding, implying involvement in zero-knowledge proof or privacy-focused crypto projects, to lure victims seeking early access or rewards. Users who visited or interacted with aztecsun.vip should assume their browser session may have been compromised. Disconnect from the internet immediately, revoke any wallet connections via your crypto wallet software (MetaMask, Phantom, etc.), and scan your system using reputable antivirus tools. Do not reconnect wallets or enter seed phrases on any site related to this domain. Report the URL to PhishDestroy and your organization's security team to aid in takedown efforts. Monitor wallet transactions for unauthorized transfers and consider transferring remaining assets to a clean wallet using an air-gapped device.