vaxstress[.]cc

PhishDestroy identifies vaxstress.cc as an active generic phishing domain distributing a crypto wallet drainer kit targeting unaware users. The domain appears designed to mimic legitimate vaccine stress-testing portals, luring victims with false promises of system load simulators while silently exfiltrating cryptocurrency wallet credentials and private keys. No specific brand is being impersonated in this campaign; the infrastructure suggests opportunistic credential harvesting rather than targeted brand abuse. The drainer payload remains unclassified at this stage, but behavioral analysis indicates automated redirection chains upon form submission.

This domain resolves to IP 38.47.191.239 and is served via a Let’s Encrypt SSL certificate. It shows 6/95 VirusTotal detections, indicating zero detection as of the latest scan. Registered through NAMECHEAP INC on April 16, 2026, the domain has not yet been flagged by Google Safe Browsing (GSB = unknown) and remains absent from public blocklists, making it a fresh threat with high reach potential. The combination of recent registration, low detection coverage, and active hosting suggests this is a rapidly evolving campaign likely still in its initial propagation phase.

Current status is ACTIVE. Immediate response includes blocking vaxstress.cc and 38.47.191.239 at the network perimeter and DNS levels. Users should avoid visiting the domain entirely. Security teams are advised to monitor for associated IP ranges and SSL cert reuse, while threat hunters should look for related drainer infrastructure leveraging similar naming conventions. Remaining risk is assessed as HIGH due to low detection coverage, fresh infrastructure, and active operation. Organizations should treat this as a Tier-1 alert and update threat intelligence feeds accordingly.