viwnex[.]top

PhishDestroy identifies viwnex.top as an active crypto drainer domain posing as legitimate brand websites to deceive users into connecting crypto wallets. This domain was flagged with zero detections across 95 VirusTotal scanners, indicating a low but active threat that has yet to be widely recognized by antivirus engines. Registered through TUCOWS.COM, CO. on April 16, 2026, the domain resolves to IP 104.21.64.216 and utilizes a Let's Encrypt SSL certificate to appear legitimate. The technical indicators for this domain are concerning. With no current blocklist presence and minimal detection rates, viwnex.top operates under the radar, leveraging freshly registered domains (April 2026) to avoid historical scrutiny. The use of a legitimate SSL certificate (Let's Encrypt) further enhances its credibility, tricking users into believing it is a trusted site. The lack of detections suggests this threat is newly emerged or employing evasion techniques to bypass traditional security measures. Users who have interacted with viwnex.top should take immediate action. Disconnect any connected crypto wallets or devices from the internet, scan for malware using reputable tools, and revoke any unauthorized permissions granted to the site. Report the domain to PhishDestroy for further analysis and block it at the network level if possible. Monitor financial accounts for suspicious transactions and consider rotating wallet credentials if any interaction occurred.