g99r[.]xyz

PhishDestroy identifies g99r.xyz as an active crypto drainer domain. This domain employs deceptive tactics to trick users into authorizing malicious transactions, likely targeting victims through social engineering or fake asset offers. The infrastructure suggests a focus on blockchain-based theft, with no known impersonation of a specific brand at this time. The drainer kit remains unspecified in current feeds, but indicators align with automated fund extraction mechanisms common in crypto scams.

This domain was flagged with a VirusTotal score of 13/95 security vendors and currently remains active. It was registered on April 24, 2026, through Gname.com Pte. Ltd., and resolves to IP 154.39.104.142 using a Let's Encrypt SSL certificate. The domain appears on 3 security blocklists, including OpenPhish and PhishingArmy. Google Safe Browsing (GSB) status is currently marked as dangerous.

g99r.xyz remains active as of the latest scan, posing a high threat to potential victims engaging with its interface. Immediate blocking via DNS, firewall rules, or security platforms is strongly advised. The domain's recent registration and rapid flagging by multiple vendors highlight the urgency of proactive defense. While current blocklist counts are documented, this campaign may evolve, requiring continuous monitoring and user education to mitigate exposure.