show[.]diwkr[.]com

This domain, show.diwkr.com, is identified as a credential harvesting phishing site targeting users through generic login impersonation. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, suggesting a broad-spectrum approach to credential theft. The infrastructure was designed to mimic legitimate login portals, likely distributing stolen credentials to threat actors for further exploitation or resale on underground forums. Infrastructure analysis reveals the domain was registered on April 02, 2026, through GoDaddy.com, LLC, and resolved to the IP address 45.152.66.68, hosted by a provider in the United Kingdom. VirusTotal detection metrics show 23 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on at least one security blocklist, and its SSL certificate was issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. As of the latest assessment, show.diwkr.com has been taken offline, reducing immediate risk to end users. However, the underlying infrastructure remains a potential threat vector, as the domain could be reactivated or repurposed for future campaigns. Organizations are advised to maintain blocklist entries for the domain and associated IP, monitor for related indicators of compromise, and educate users on recognizing generic phishing attempts. Network-level protections should prioritize blocking known malicious IPs and domains linked to this threat cluster.