vireluneqastorix[.]live

PhishDestroy identifies vireluneqastorix.live as a previously unreported crypto drainer phishing domain under active investigation. This domain employs a generic phishing kit designed to deceive cryptocurrency users, likely harvesting seed phrases or wallet credentials through fake login prompts or transaction simulations. The threat appears unbranded, suggesting opportunistic targeting rather than focused impersonation of a specific exchange or wallet provider. This domain was flagged with a VirusTotal detection score of 1 out of 95 engines at the time of analysis. The domain resolves to IP address 172.67.148.175 and operates under a Let's Encrypt SSL certificate. It was registered on May 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. As of this report, the domain is not listed on Google Safe Browsing (GSB) and remains unblocked by major threat intelligence platforms. The absence of detections and blacklist coverage indicates novel deployment and low public awareness, increasing the likelihood of interaction from unsuspecting users. Current status of vireluneqastorix.live is classified as active under investigation. PhishDestroy has initiated forensic monitoring and continues to track propagation vectors, including potential social media, forum, or phishing campaign distribution. The risk remains medium due to the emerging nature of the threat and lack of widespread blocking; however, the use of legitimate hosting infrastructure (Cloudflare IP range) complicates immediate mitigation. Users are strongly advised to verify any links to this domain using PhishDestroy prior to interaction and to avoid entering wallet credentials or seed phrases on untrusted sites.