1win-app-venezuela[.]com

PhishDestroy identifies 1win-app-venezuela.com as an active crypto–draining domain falsely mimicking the 1win brand. Registered through Fewmoretaps OU (d/b/a Trustname.com) on 04 April 2026, the domain resolves to 104.21.31.215 and currently carries no SSL warnings thanks to a Let’s Encrypt certificate. The operator appears to be deploying a crypto–drainer kit aimed at siphoning wallet credentials and assets under the guise of a legitimate 1win Venezuela application.

Key technical indicators place this threat at the “under investigation” stage with the following exact profile: 0 detections on VirusTotal out of 95 engines as of seed 008af4, registrar Trustname.com, IP 104.21.31.215, domain creation date 04 April 2026, SSL issued by Let’s Encrypt (R3), and no Known Google Safe Browsing flag at time of analysis. Public blocklists have yet to include this domain, leaving a clean record against automated defenses despite its malicious intent.

Current status is active; the domain remains unblocked by mainstream browsers and security suites, indicating a window of opportunity for illicit operations. Immediate defensive actions include blacklisting 104.21.31.215 and 1win-app-venezuela.com at DNS/firewall layers, revoking the Let’s Encrypt certificate via CT logs, and alerting 1win brand protection teams to accelerate takedown requests. Remaining risk is assessed as moderate-to-high; although no drainer artifacts have yet been extracted publicly, TLS-seeded phishing flows and automated credential harvesting scripts are expected to emerge within 72–96 hours if left unchecked.