web3deribit[.]vip

Analysis of the domain web3deribit.vip indicates it is an active phishing site targeting users of the Deribit cryptocurrency exchange. The domain was registered on July 14, 2026, through the registrar July Name Limited, a provider frequently associated with recently created malicious domains. Infrastructure analysis reveals the domain resolves to the IP address 121.127.232.162, which has been linked to other phishing campaigns in recent months. The nameservers ns1.julydns.com and ns2.julydns.com further suggest a pattern of ephemeral hosting, a common tactic among threat actors to evade takedowns. Detection data shows limited but targeted flagging: two of 95 security vendors on VirusTotal have identified the domain as malicious, while it appears on three distinct security blocklists. The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, indicating recognition by both general anti-phishing tools and cryptocurrency-specific security platforms. The use of 'web3' in the domain name, combined with the Deribit branding, suggests an intent to deceive users into believing the site is an official Web3 or decentralized finance (DeFi) portal associated with Deribit. At the time of this report, the domain remains active, and no evidence of a takedown request or registrar suspension has been observed. The exact content and functionality of the site have not been analyzed, but the combination of cryptocurrency-related branding and recent registration strongly suggests it is designed to harvest credentials or private keys. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network levels. Organizations operating in the cryptocurrency space are advised to monitor for user reports of phishing attempts involving this domain and to educate users about the risks of interacting with unofficial or newly registered exchange-related sites.