flowshare[.]cv

PhishDestroy identifies the domain FlowShare.cv as an active generic phishing threat targeting cryptocurrency users under seed 5fd27d. The threat poses as a legitimate file-sharing service but is engineered to harvest login credentials and wallet keys through deceptive landing pages and fake download prompts. While no specific drainer kit has been attributed yet, the infrastructure closely mimics established brands to trick victims into authorizing fraudulent blockchain transactions. The domain contains no clear branding affiliation and exhibits high-risk behaviors typical of clipboard hijackers and wallet drainers, warranting immediate user caution and network-level blocking. This domain was flagged with a current VirusTotal detection score of 1/95 engines, indicating it remains undetected by most antivirus tools as of seed 5fd27d. It resolves to IP address 172.67.146.241 and was registered through NAMECHEAP INC on March 17, 2026. Google Safe Browsing has not yet flagged this domain, and it does not appear on major threat intelligence blocklists. These technical indicators suggest a newly deployed or intentionally evasive campaign operating under the radar of traditional defenses. The status of FlowShare.cv remains active, with no takedown or deactivation observed at this time. Users are advised to avoid accessing the domain and to report any suspicious activities to their security teams or relevant financial platforms. While the risk level is currently under investigation, the combination of recent registration, SSL usage via Let's Encrypt, and zero detections signals a high probability of escalating attacks. Security teams should implement network rules to block traffic to 172.67.146.241 and inspect internal endpoints for signs of wallet compromise or credential harvesting. Remaining risk is assessed as moderate to high due to the domain's active status and low detection coverage.