secondfi-wallet[.]io

The domain secondfi-wallet.io was registered on June 30, 2026 through Squarespace Domains LLC and is currently resolved to the IPv4 address 91.92.241.250, which belongs to AS202412 operated by Omegatech LTD in the Netherlands. The site presents a page titled “SecondFi Wallet | The Evolved Yoroi Wallet” and serves content over HTTPS using a Let’s Encrypt certificate (identifier YR1). An HTTP 200 response is observed, and the server stack includes Nginx with HTTP/3 support. VirusTotal analysis shows that only one of ninety‑five scanning engines has flagged the domain, indicating a low detection rate despite the presence of malicious activity. Independent blocklists confirm the threat: the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The combination of a newly created domain, a legitimate‑looking SSL certificate, and low vendor detection suggests a deliberate attempt to evade automated filters. The observed behavior aligns with a crypto drainer campaign. The page mimics the Yoroi wallet interface, aiming to lure users into approving transactions that transfer cryptocurrency assets to attacker‑controlled addresses. Infrastructure analysis reveals a single host serving the malicious front‑end, with no additional IPs or CDN distribution observed. The use of Squarespace nameservers (nsb1‑nsb4.squarespacedns.com) provides a degree of legitimacy that may assist social engineering. Defenders should add secondfi-wallet.io to internal blocklists and enforce DNS filtering for the domain and its associated IP. Monitoring for outbound connections to 91.92.241.250 and for SSL certificate usage matching the Let’s Encrypt YR1 identifier can improve detection. Incident response teams are advised to warn users of the fraudulent wallet prompt and to advise removal of any approved transaction approvals associated with the site.