zenvabet[.]com

PhishDestroy identifies zenvabet.com as an active crypto drainer phishing domain designed to steal cryptocurrency assets by impersonating legitimate payment platforms, specifically targeting ZenePay users. This domain employs deceptive tactics to trick victims into connecting wallets and approving fraudulent transactions. The infrastructure behind zenvabet.com appears to be part of a broader campaign leveraging spoofed payment gateways to harvest private keys and drain funds. zenvabet.com resolves to IP address 188.114.97.3 and was registered on April 19, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar known for enabling high-risk domain registrations. The domain utilizes a Let’s Encrypt SSL certificate to appear legitimate, and as of the latest scan, only 1 out of 95 VirusTotal security vendors flagged it as malicious. The domain has not yet been listed on Google Safe Browsing (GSB) and remains unblocked by major threat intelligence platforms, increasing its potential reach. The domain remains active and continues to pose an elevated risk to cryptocurrency users. PhishDestroy has flagged zenvabet.com and is tracking its infrastructure across affiliate networks. Users are advised to avoid interacting with this domain and verify any payment-related URLs through PhishDestroy’s threat intelligence database. While immediate countermeasures have been deployed, the domain’s recent registration and low detection rates suggest ongoing evasion tactics. Remaining risk remains elevated due to its active status and lack of broad detection.