crwvt[.]bid

This domain, crwvt.bid, operates as a brand impersonation phishing site specifically targeting users of the Solana cryptocurrency platform. The site mimics legitimate Solana interfaces to deceive visitors into disclosing sensitive credentials, such as wallet private keys or recovery phrases, which could lead to unauthorized access and asset theft. The use of technologies like Bootstrap and jQuery suggests an attempt to replicate the visual and functional elements of authentic Solana pages, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Analysis indicates that crwvt.bid was registered through Dynadot LLC on March 06, 2025, and resolves to the IP address 23.225.199.93. The domain appears on one security blocklist and has been flagged by 9 out of 95 security vendors on VirusTotal, reflecting an elevated risk level. Additional technical indicators include the presence of HSTS, Caddy, Swiper, and Lodash, which are consistent with modern web development practices but do not mitigate the malicious intent of the site. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its classification as a high-risk phishing resource. Users who visited crwvt.bid should immediately cease all interaction with the domain and assume that any credentials or sensitive information entered may have been compromised. It is recommended to revoke access to any connected cryptocurrency wallets, monitor accounts for unauthorized transactions, and update security settings on all related platforms. If wallet credentials were exposed, transferring assets to a new, secure wallet is strongly advised. Additionally, affected users should report the domain to relevant security teams and consider implementing multi-factor authentication to prevent further unauthorized access.