admin[.]deribit-trade[.]com

The domain admin.deribit-trade.com has been identified as a generic phishing site specifically designed to impersonate the legitimate cryptocurrency exchange Deribit. PhishDestroy's analysis confirms that this domain was created with malicious intent, likely aiming to steal login credentials and cryptocurrency assets from unsuspecting users. The threat type is consistent with a fake login page that mimics Deribit's authentication interface, potentially deploying a crypto drainer to exfiltrate funds.

Technical indicators paint a clear picture of this domain's malicious nature. VirusTotal reports that 3 out of 95 security vendors flag this domain as malicious, and it appears on 3 separate security blocklists, including Google Safe Browsing. The domain was registered through NameSilo, LLC and resolves to IP address 188.114.96.3, which is associated with Cloudflare. The SSL certificate was issued by Let's Encrypt (E7), a common choice for phishing sites due to its free availability. The domain was created on May 13, 2026, a relatively recent date that aligns with its phishing campaign.

As of the latest report, the domain has been taken offline, indicating that either the hosting provider or registrar responded to abuse reports. However, users should remain vigilant as similar domains may still be active. PhishDestroy advises anyone who may have interacted with this site to immediately change their Deribit credentials and enable two-factor authentication. No remaining risk is identified for this specific domain, but users should always verify URLs directly through official channels before entering sensitive information.