zorvyn[.]live

PhishDestroy identifies zorvyn.live as an active crypto drainer phishing domain with an elevated risk rating, deployed to steal cryptocurrency and credentials from unsuspecting users.

This domain was flagged on April 12, 2026, shortly after registration through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 20.101.2.157, which is equipped with a DigiCert SSL certificate, likely to appear trustworthy. Only 1 out of 95 VirusTotal security vendors currently flags this domain as malicious, underscoring the stealthy nature of the threat. The low detection rate suggests this campaign may be in early stages or targeted at specific victims.

Given the specific threat type—crypto drainer impersonating cryptocurrency platforms—users should avoid interacting with zorvyn.live entirely. If accessed, verify the domain’s authenticity using PhishDestroy’s real-time blocklist. Never enter wallet credentials or private keys on this site. Report any encounters to your security team for immediate takedown requests. Organizations are advised to block traffic to 20.101.2.157 at the firewall level and inspect certificate trust chains for similar domains.