thedarkvr[.]su

PhishDestroy identifies thedarkvr.su as an active crypto drainer phishing domain currently under investigation by the anti-phishing unit. The site mimics legitimate virtual reality platforms to trick users into connecting crypto wallets and draining funds. This domain is deployed with infrastructure designed to harvest private keys and authorization tokens under the guise of ‘exclusive VR content access’. thedarkvr.su was registered on October 08, 2025 through REGRU-SU and resolves to IP 188.114.96.3. As of the latest scan, the domain remains unflagged on VirusTotal with 0 detections out of 95 participating vendors. The site holds a valid SSL certificate issued by Google Trust Services, which may be leveraged to increase user trust. Despite its clean detection score, the domain’s recent creation date, absence from public blocklists, and SSL trust score suggest a newly launched campaign with low detection latency. Behavioral analysis indicates redirection pathways consistent with crypto drainer toolkits, including prompt wallet connection requests upon page load. Users are strongly advised to avoid interacting with thedarkvr.su and to report any encounters via PhishDestroy’s verification portal. Given the domain’s active status, low detection coverage, and the presence of a trusted SSL certificate, the risk of exposure to wallet compromise remains elevated. Immediate actions include blocking the domain at the network level, scanning endpoints for unauthorized crypto wallet connections, and validating all URLs before engagement. PhishDestroy continues to monitor this domain and will update its status as new intelligence becomes available.