diw[.]vc

This domain, diw.vc, is identified as part of a crypto drainer phishing infrastructure targeting cryptocurrency wallet users. The site impersonates Divergence Ventures, a legitimate venture capital entity, to deceive victims into connecting wallets or entering seed phrases. The attack vector likely involves malicious smart contract interactions or fake token airdrop schemes designed to siphon funds from compromised wallets. Analysis of the domain reveals characteristics consistent with crypto-focused phishing operations, including the use of Web3-related technologies such as Three.js, which may facilitate interactive or deceptive user interfaces to mimic legitimate decentralized applications. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on April 18, 2026, through DYNADOT LLC, a registrar frequently observed in phishing campaigns. Despite its current offline status, diw.vc resolves to the IP address 193.233.82.84 and has been flagged on two security blocklists, including PhishDestroy and ScamSniffer. VirusTotal reports zero detections out of 95 engines (0/95), indicating the infrastructure may still evade automated detection systems. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Detected technologies include Ubuntu, Apache HTTP Server, Cloudflare, and Google Analytics, suggesting a professionally hosted environment designed to appear credible while masking its true intent. Users who visited diw.vc or interacted with its content should take immediate action to mitigate potential risks. First, disconnect any cryptocurrency wallets that may have been linked to the site and revoke permissions for all connected decentralized applications using tools like Etherscan or BscScan. Monitor wallet activity for unauthorized transactions, particularly those involving token approvals or fund transfers. If seed phrases or private keys were entered, consider the wallet compromised and transfer all assets to a new, secure wallet. Additionally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Report the domain to relevant security communities and blocklist providers to aid in broader threat mitigation efforts.