vekbit[.]com

PhishDestroy identifies vekbit.com as an active crypto drainer domain designed to extract cryptocurrency assets from unwitting users. Positioned under the generic_phishing threat classification, this site leverages deceptive tactics to impersonate reputable crypto platforms, tricking victims into connecting wallets or entering credentials. While the exact drainer kit remains unconfirmed in open intelligence channels, the site’s operational design strongly suggests the use of automated script-based theft mechanisms targeting browser-based wallet integrations. Given the domain’s recent registration and lack of detection, it poses a significant emergent threat to crypto investors engaging with unfamiliar or newly launched platforms.

Technical indicators reveal a concerning profile: vekbit.com was created on April 29, 2026, resolving to IP address 172.67.142.153. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and secured via a Let’s Encrypt SSL certificate, adding superficial legitimacy. As of current scans, the domain shows 0 detections on VirusTotal (analysis as of seed 90f9b5), indicating it remains undetected by most security engines. While Google Safe Browsing (GSB) status is not yet flagged, and blocklist counts remain at zero, this low detection footprint is atypical for a domain only days old, raising red flags for proactive threat responders.

The domain is currently classified as active and under investigation, with risk assessed as elevated due to the combination of zero detections and high-risk operational context. Immediate containment actions include domain blacklisting at network and endpoint levels, user advisories across crypto communities, and coordination with hosting providers and registrars for potential takedown. Remaining risk remains high as the site continues to propagate undetected, with recent creation date and limited historical data contributing to uncertainty. Users are advised to avoid vekbit.com entirely, verify all crypto-related domains via official channels, and report any encounter to their security teams or through crypto phishing reporting portals. Early intervention is critical to prevent asset loss.