m[.]tirveavip[.]cc

This domain, m.tirveavip.cc, is identified as a high-risk phishing resource designed to impersonate the Trive cryptocurrency platform. Analysis indicates the site employs generic phishing tactics aimed at harvesting wallet credentials and private keys, likely deploying a drainer kit to siphon digital assets from compromised accounts. The page title, 'Trive,' directly mimics the legitimate service, increasing the likelihood of successful deception among users seeking wallet management or transaction verification. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on March 10, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent registrations. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is commonly leveraged to obfuscate origin servers. Detection metrics show 14 out of 95 security vendors on VirusTotal flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing threat. The domain appears on three distinct security blocklists, including those maintained by cryptocurrency-focused threat intelligence providers. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently employ valid certificates to appear legitimate. As of the latest assessment, m.tirveavip.cc has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, residual risk persists due to the potential for rapid re-deployment under a new domain or IP address. Users who interacted with the site are advised to immediately revoke any connected wallet permissions, transfer assets to a secure wallet, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, while security teams should investigate related infrastructure for signs of broader campaign activity.