inactive-x[.]com

PhishDestroy identifies inactive-x.com as a generic phishing domain actively distributing a crypto drainer kit targeting cryptocurrency wallet users. The domain mimics legitimate services to trick victims into connecting wallets or entering private keys, enabling unauthorized fund transfers. Technical analysis suggests the threat actor is leveraging a newly registered domain to evade early detection, with infrastructure designed to facilitate rapid fund exfiltration upon wallet compromise. This domain was flagged by PhishDestroy’s automated pipeline with a VirusTotal detection score of 3/95, indicating it remains under the radar of most security vendors. The domain was registered through Dynadot Inc on April 12, 2026, and resolves to IP 188.114.96.3. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors to establish a false sense of legitimacy. As of this report, the domain has not been added to Google Safe Browsing (GSB) or any major blocklists, leaving users vulnerable to exposure. The domain remains active and is currently under investigation by PhishDestroy’s threat intelligence team. Immediate response actions include domain sinkholing to disrupt traffic and coordination with hosting providers to mitigate further abuse. However, due to the lack of widespread detection, the risk remains elevated for users who may encounter this domain through unsolicited links or malicious advertisements. Users are strongly advised to verify links using PhishDestroy’s tools before interacting with any crypto-related websites.