vzcxiw[.]com

PhishDestroy identifies www.vzcxiw.com as an active cryptocurrency wallet drainer site under active phishing investigation. The domain was created on May 10, 2024, and is currently resolving to IP address 108.138.7.45. VirusTotal shows zero detections (2/95 engines) despite confirmed malicious payload delivery to crypto wallet users. The site employs a fraudulent SSL certificate issued by Amazon, creating false trust signals while facilitating credential harvesting and unauthorized transaction approvals. No specific brand impersonation or drainer kit signature has been released publicly at this stage of analysis. This domain exhibits multiple high-risk technical indicators consistent with active phishing infrastructure. VirusTotal detection rate remains at 2/95 despite confirmed malicious activity, indicating either zero-day indicators or obfuscation techniques bypassing current detection. The domain is registered through Hefei Juming Network Technology Co., Ltd., a registrar known for accommodating high-risk registrations. Creation date May 10, 2024, suggests recent deployment as part of coordinated phishing campaigns. Google Safe Browsing (GSB) status remains unflagged, and the domain has not yet appeared on major blocklists despite active malicious operations. The IP address 108.138.7.45 hosts multiple suspicious domains, increasing threat confidence. Current status remains active with confirmed malicious operations targeting cryptocurrency users. PhishDestroy continues monitoring for additional indicators and has flagged the domain for immediate browser-based blocking. The zero detection rate on VirusTotal represents a significant risk as traditional security tools remain unaware of this threat. Users should avoid this domain entirely and report any interactions to their security teams. Remaining risk is assessed as HIGH due to undetected status, recent deployment, and active malicious operations. Immediate blocking at network level is recommended while the investigation continues.