greyvestbk[.]com

greyvestbk.com is identified as an active crypto drainer phishing site, currently operational and posing as a Grey Vest financial platform. The threat involves malicious scripts designed to drain cryptocurrency wallets upon interaction. This domain is part of an ongoing campaign targeting users with deceptive financial incentives under the guise of legitimate investment services.

This domain was flagged by 3 of 95 VirusTotal security vendors, indicating early-stage detection with limited coverage. It was registered through DYNADOT LLC, resolves to IP 163.61.188.7, and was created on June 14, 2025. The domain holds no established trust scores and has not yet been widely blocked by major threat intelligence platforms. Its recent creation and low detection rate suggest a rapidly evolving threat with potential for escalation.

As of June 2025, greyvestbk.com remains active and should be treated as a high-risk domain. Users are strongly advised to avoid interaction and verify any financial-related links using PhishDestroy or similar threat intelligence tools. Organizations should consider blocking this domain and associated IP at the network perimeter to prevent access. Immediate reporting to cybersecurity teams or threat intelligence platforms is recommended to aid in mitigation and tracking of this campaign.