qagamb[.]cc

PhishDestroy identifies qagamb.cc as an active cryptocurrency drainer domain designed to trick users into approving malicious token transfers. This domain mimics legitimate crypto platforms to siphon digital assets via fraudulent smart contract approvals. No specific brand impersonation has been confirmed, but the site employs generic wallet drainer kits common in 2026 campaigns targeting decentralized finance users. The infrastructure leverages a deceptive domain age (registered March 20, 2026) and a Let's Encrypt SSL certificate to appear credible.

This domain was flagged with 6/95 VirusTotal detections as of seed b194e2, indicating zero antivirus coverage despite active phishing operations. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP 172.67.198.90. The domain lacks Google Safe Browsing (GSB) classification and remains unlisted on major threat intelligence blocklists, enabling prolonged accessibility to potential victims. The March 2026 creation date suggests a recently deployed campaign, likely exploiting low initial detection rates to maximize impact.

qagamb.cc remains active with an 'under_investigation' status, indicating ongoing monitoring but no immediate takedown action. Users are advised to avoid interaction and report the domain to their security teams. Remaining risk is high due to unblocked status and zero detections, warranting immediate network-level blocking via firewall rules targeting 172.67.198.90 and domain-level restrictions. Organizations should audit wallet approvals for unauthorized transactions linked to this domain.