referral[.]maxbid[.]pro

PhishDestroy identifies referral.maxbid.pro as an active cryptocurrency-draining campaign posing under the brand name Maxbid App. The domain serves a spoofed landing page titled 'Maxbid App Is Live' that harvests wallet credentials and facilitates unauthorized transfers. No known malware kit or JavaScript obfuscation has been retrieved so far, suggesting a lightweight drainer script tailored to the campaign. The threat type is specifically a wallet-drainer phishing site impersonating a legitimate crypto application.

Technical indicators show the domain resolves to IP 76.76.21.164 and uses a Let’s Encrypt SSL certificate with host maxbid.pro. VirusTotal currently returns 0/95 engine detections despite active traffic, indicating a low detection footprint. Registrar is Namecheap, domain creation date was 2024-05-14, and Google Safe Browsing status is currently marked as benign. The domain has zero listings on blocklists at the time of analysis.

Campaign status remains active with ongoing lure distribution via social media and paid ads. No takedown actions have been observed yet. Remaining risk is assessed as HIGH given the drainer’s primary objective and zero detections. Users are advised to block referral.maxbid.pro at DNS and network levels, refrain from connecting wallets to any site not explicitly whitelisted, and report new fraudulent URLs to their security teams immediately.