vispwzsf[.]web[.]app

PhishDestroy identifies vispwzsf.web.app as an active crypto drainer domain posing significant risk to cryptocurrency users. This domain employs deceptive techniques to trick victims into connecting wallets, enabling unauthorized fund transfers to attacker-controlled addresses. The threat level remains high due to its current operational status and the involvement of sophisticated social engineering tactics designed to bypass security awareness. Domain analysis reveals multiple red flags across multiple security platforms. VirusTotal confirms detection by 11 out of 95 security vendors, indicating widespread recognition as malicious. The domain was registered through Google LLC and resolves to IP address 199.36.158.100, which has been associated with previous phishing infrastructure. Notably, this domain appears on one security blocklist and maintains an active status despite efforts to contain it. The SSL certificate issued by Google Trust Services adds a veneer of legitimacy, potentially increasing the success rate of impersonation attempts. The page title 'Redirection...' suggests immediate redirection to secondary malicious payloads upon access. Mitigation requires immediate action from both users and security teams. Cryptocurrency holders should treat any connection requests to this domain as highly suspicious, particularly those involving wallet connections or transaction approvals. Organizations should implement DNS filtering to block access to this domain and its IP address. Additionally, security teams should monitor network traffic for connections to 199.36.158.100 and investigate any wallet interactions involving this infrastructure. User education regarding wallet connection risks and the importance of verifying domain legitimacy before any interaction remains critical. Immediate reporting of any observed activity involving this domain to relevant threat intelligence platforms is strongly encouraged to aid collective defense efforts.