upgrader[.]is

PhishDestroy identifies upgrader.is as a confirmed fake upgrade phishing site with an active drainer kit, targeting users seeking software upgrades. The domain mimics legitimate upgrade portals to deceive visitors into downloading malicious payloads. As of July 2025, this domain is weaponized to harvest credentials and cryptocurrency through fraudulent upgrade prompts.

This domain was flagged by PhishDestroy with a VirusTotal detection score of 1/95, indicating no antivirus engines currently flag it as malicious. The domain resolves to IP 104.26.10.182, registered through Let's Encrypt for SSL encryption. Registered on July 02, 2025, it remains unblocked by Google Safe Browsing (GSB) and has not been listed on major threat intelligence blocklists. Its recent registration and lack of detections suggest an emerging threat actively evading automated detection.

As of now, upgrader.is remains active and poses a high risk to visitors expecting legitimate upgrade services. Users are strongly advised to avoid interacting with this domain. PhishDestroy recommends blocking this domain at the network level and reporting it to your organization's security team. The risk level is under investigation but currently assessed as active and escalating. Monitor updates for newly detected IOCs (Indicators of Compromise).