grimyworks[.]com

PhishDestroy identifies grimyworks.com as an active crypto drainer phishing domain, likely impersonating blockchain or wallet services to siphon funds from unsuspecting victims. The site operates under a generic brand facade to evade detection while deploying drainer scripts to exploit wallet connectivity. Analysis suggests automated bots scrape user-agent headers to deliver tailored malware payloads, increasing the risk of asset loss. This domain was flagged with 0 detections out of 95 on VirusTotal, showing negligible coverage from security engines. The site is registered through Fewmoretaps OU d/b/a Trustname.com, resolving to IP 208.82.114.165 and using a Let’s Encrypt SSL certificate. Registered on April 14, 2026, it remains unflagged by Google Safe Browsing and has not yet appeared on major blocklists, indicating a recently emerged threat. Current status: domain remains active with elevated phishing risk. Immediate actions include domain blocking at the network and endpoint level, updating browser blacklists, and disabling SSL inspection for this domain to prevent bypass tactics. Remaining risk is classified as high due to the drainer’s adaptive delivery mechanism and lack of detection coverage. Users are advised to avoid interacting with grimyworks.com and report any wallet-related prompts to their security team.