hwsvault[.]co[.]com

The domain hwsvault.co.com was a phishing site engaged in brand impersonation targeting Ethereum users. It presented itself as a hardware wallet storage solution under the name 'HwsVault' but was designed to deceive victims into disclosing cryptocurrency-related credentials or transferring funds to attacker-controlled wallets. No drainer kit was identified, though the site operated as a cryptocurrency scam. hwsvault.co.com is currently taken offline and no longer accessible.

Technical indicators confirm the domain's malicious intent. As of analysis, hwsvault.co.com was flagged by 1 of 95 VirusTotal security vendors, specifically Gridinsoft, and appeared on one security blocklist, PhishDestroy. Google Safe Browsing did not flag the domain. Registered through Moniker Online Services LLC on February 21, 2026, the domain resolved to IP address 186.2.162.174, hosted by IQWeb FZ-LLC (AS59692) in Belize. The SSL certificate was issued by R10, and the observed page title was 'HwsVault - Hardware Wallet Storage Solutions'. Nameservers were ns1.nic.co.com, ns2.nic.co.com, ns3.nic.co.com, and ns4.nic.co.com.

Individuals who interacted with hwsvault.co.com should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. Enable two-factor authentication on all cryptocurrency accounts and monitor for unauthorized transactions. Report the phishing domain to the impersonated brand, Ethereum, and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.