nextepochmarket[.]xyz

PhishDestroy identifies nextepochmarket.xyz as an active crypto drainer phishing domain, designed to trick users into unknowingly authorizing malicious cryptocurrency transfers. The site impersonates legitimate crypto platforms, luring victims with false promises of exclusive investment opportunities while deploying sophisticated JavaScript-based drainer scripts. Upon interaction, these scripts surreptitiously drain connected wallets of tokens and NFTs without explicit consent, leveraging deceptive UI elements to obscure transaction details. Users who connect their wallets risk irreversible financial losses as funds are immediately siphoned to attacker-controlled addresses under the guise of 'processing fees' or 'verification steps'. This domain was flagged after analysis revealed critical red flags, including its recent registration through Gname.com Pte. Ltd. on May 02, 2026—an unusually short timeframe for a legitimate platform. The domain resolves to IP address 172.67.135.66 and uses a Let's Encrypt SSL certificate to appear legitimate, though this alone offers no guarantees of safety. Notably, VirusTotal reports zero detections (8/95 scanners) as of the latest query, indicating a novel or evasive threat that evades conventional detection methods. The absence of prior blocklist entries suggests this campaign may be in its early operational phase, targeting unsuspecting users who bypass basic security checks. If you've visited nextepochmarket.xyz or connected a wallet, immediately revoke any active permissions via your wallet provider's security settings and transfer remaining assets to a clean wallet. Do not interact further with the domain—even if prompted to 'reconnect' or 're-authenticate.' Report the domain to PhishDestroy for deactivation and share your findings with your wallet provider to aid in blocking the associated addresses. Exercise heightened caution with domains registered within the last 30 days, and always verify URLs against trusted sources before engagement. Enable multi-factor authentication on all crypto accounts and use hardware wallets for sensitive transactions to mitigate exposure to drainer scripts.