crimsonwave[.]world

PhishDestroy identifies crimsonwave.world as a brand impersonation phishing domain targeting Discord, though its page title reads 'Shade Network — The Private Execution Layer,' suggesting a broader credential or crypto harvesting campaign. The domain was created on July 05, 2025, and registered through NameCheap, Inc., an elevated risk indicator as this registrar is frequently abused. No specific drainer kit was identified, but the combination of impersonation and an unrelated page title heightens suspicion.

Technical indicators paint a clear threat picture: VirusTotal records 3 out of 95 security vendors flagging the domain, while three separate security blocklists already list it. The domain resolves to IP 172.67.169.63 and uses an SSL certificate from Google Trust Services / WE1, which is standard but does not imply safety. Despite being taken offline, its recent creation date and blocklist presence confirm malicious intent. Google Safe Browsing status is not explicitly listed, but the offline status suggests active takedown efforts.

As of the latest analysis, crimsonwave.world is offline, likely due to hosting provider or registrar intervention following threat reports. However, remaining risk includes possible re-activation under the same registrar or IP range. Users who encountered this domain should avoid any interaction and change credentials if they entered login information. PhishDestroy continues to monitor for related infrastructure and recommends enabling multi-factor authentication on all Discord accounts.