login[.]drwtrade[.]com

This domain is flagged as a credential phishing target as of August 03, 2026, and is currently active. Analysis indicates that the domain is listed on three independent security blocklists and is being blocked by PhishDestroy, MetaMask, and SEAL, which are known for identifying malicious or high-risk web properties. VirusTotal reports that 91 vendors have scanned the domain, with zero currently flagging it; however, this absence of detections is not proof of safety, as many phishing domains evade automated scanning initially or are only flagged after broader distribution. The domain is under investigation, meaning the definitive threat classification is based on threat intelligence sources rather than a confirmed infection or a successful credential theft event at this time. The exact content of the domain has not been analysed, so the specific brand or login interface it may imitate is unverified; the credential phishing classification comes from the blocklist data and the threat type supplied.

Defenders should treat this domain as hostile and proactively block it at the DNS, email gateway, and web proxy levels. Users who have entered credentials on this domain should assume those credentials are compromised and rotate them immediately on the legitimate services they use. The risk level is currently 'under investigation,' which suggests that additional analysis is ongoing to confirm the full scope of the threat, including potential ties to a phishing kit or a specific targeted brand. Given the active status, the domain may still be operational, and defenders should monitor for any subdomains or related infrastructure that could emerge. No information is available regarding the registrar, hosting provider, IP address, or SSL certificate, so those aspects remain unassessed.

It is recommended to submit the domain to additional threat intelligence platforms and to review any internal logs for connections to login.drwtrade.com to identify potential victims.