phemexdexminer[.]ltd

This domain, phemexdexminer.ltd, is confirmed to operate as a crypto drainer platform designed to impersonate the legitimate Phemex decentralized exchange infrastructure. Analysis indicates the site employs deceptive interfaces to trick users into connecting cryptocurrency wallets, subsequently executing unauthorized transactions that drain funds without consent. The presence of wallet interaction scripts and simulated mining dashboards strongly suggests financial theft as the primary objective, targeting users unfamiliar with legitimate Phemex services. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain resolves to IP address 104.21.22.130 and was registered through Hosting Concepts B.V. d/b/a Registrar.eu. Security vendors on VirusTotal flagged the domain in 4 out of 95 scans, while independent trust scoring systems assigned a risk rating of 1/100. The site appears on one security blocklist and utilizes Cloudflare services for hosting and SSL termination via Google Trust Services. Detected technologies include jQuery, jQuery UI, and FancyBox, which are commonly employed to create convincing fraudulent interfaces. Users who visited phemexdexminer.ltd should immediately revoke any connected wallet permissions and transfer remaining assets to a new, secure wallet address. All devices used to access the site should undergo malware scanning to detect potential secondary infections. Cryptocurrency transactions initiated through this domain should be reported to relevant blockchain analysis platforms for tracking. Visitors are advised to monitor their wallet activity for unauthorized transfers and consider implementing additional security measures such as hardware wallets for future interactions with decentralized services.