blockvestholdings[.]top

PhishDestroy identifies blockvestholdings.top as an active crypto drainer phishing domain targeting BlockVest Holdings investors. The domain employs a generic phishing kit designed to steal cryptocurrency wallet credentials and initiate unauthorized transfers. Security vendors report this domain masquerades as the legitimate BlockVest Holdings platform, leveraging social engineering tactics to trick users into connecting their digital wallets or entering sensitive financial information. The threat actor behind this campaign has repurposed infrastructure typically associated with investment scams to harvest credentials and drain victim wallets under the guise of portfolio management or investment opportunities.

Technical indicators confirm blockvestholdings.top is a high-risk domain registered on April 23, 2026, through Global Domain Group LLC and resolving to IP address 37.49.229.75. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate and has been flagged by 1 out of 95 VirusTotal security vendors. Google Safe Browsing (GSB) has not yet classified this domain, and no public blocklists currently include it. The domain's recent creation date and low VT detection rate suggest it is a newly deployed threat with limited exposure to traditional security engines.

blockvestholdings.top remains active as of the latest analysis, with no known takedown or mitigation by hosting providers or registrars. Users should treat this domain as a confirmed threat and avoid all interaction. The elevated risk of financial loss through cryptocurrency theft warrants immediate avoidance and potential reporting to relevant authorities or threat intelligence platforms. Remaining risk is high due to the domain's active status, low detection footprint, and potential for continued use in similar campaigns. Immediate action is advised to prevent credential compromise and wallet draining.