vg123plus7[.]com

PhishDestroy identifies vg123plus7.com as an active crypto drainer domain designed to siphon cryptocurrency from unsuspecting users. The site impersonates legitimate crypto services to trick victims into connecting wallets, triggering malicious smart contract calls that drain funds without authorization. No specific drainer kit signature (e.g., Inferno Drainer, Angel Drainer) has been publicly attributed yet, but behavioral patterns align with automated crypto theft campaigns observed in Q2 2026.

This domain was flagged with 0/95 VirusTotal detections at the time of analysis, indicating a low antivirus detection rate typical of emerging crypto drainers. It was registered on April 28, 2026, through GoDaddy.com, LLC, and resolves to IP 188.114.96.3. The site holds a valid SSL certificate issued by Google Trust Services, increasing user trust while masking malicious intent. It remains unlisted on Google Safe Browsing (GSB) and shows no current presence on major threat blocklists, suggesting it is newly operational and flying under the radar.

Current status is active and under investigation, with no takedown or mitigation in place. Users should immediately block this domain at the network level and avoid any interaction. Remaining risk is high due to the domain’s recent creation, low detection rate, and active operational status. Exercise extreme caution with wallet connections and crypto transactions—verify every site independently before use.