cxbull[.]com

PhishDestroy identifies cxbull.com as an active crypto drainer domain currently under investigation for malicious activity.

This domain, registered through Ultahost, Inc., resolves to IP 104.21.57.236 and utilizes a Let's Encrypt SSL certificate. The domain was created on February 12, 2025, and currently exhibits zero detections across 95 VirusTotal vendors. Despite its new registration, this domain has not yet been widely flagged by threat intelligence platforms, indicating potential emerging threat activity.

Given its low detection rate and active status as a crypto drainer, cxbull.com poses a significant risk to users engaging in cryptocurrency transactions. The domain's infrastructure, including its hosting provider and SSL certificate, suggests opportunistic malicious activity rather than sophisticated evasion techniques. As of this advisory, no known blocklist entries or trust score degradations have been recorded for this domain. To mitigate exposure, organizations and individuals should immediately block cxbull.com at the network perimeter and DNS level. Users should also audit any recent cryptocurrency transactions for unauthorized transfers and report suspicious wallet addresses to relevant authorities. Enhanced monitoring of outbound traffic to this domain is strongly advised to prevent potential financial losses.