tezos-wallet[.]io

This domain is flagged as an elevated-risk crypto drainer targeting Tezos (XTZ) cryptocurrency holders. Analysis indicates the site operates as a fraudulent wallet interface designed to siphon funds by tricking users into connecting their wallets to malicious smart contracts. The specific threat type—crypto drainer—poses immediate financial risk to victims, as compromised wallets may experience unauthorized transactions and irreversible asset loss. Infrastructure analysis reveals the domain tezos-wallet.io was registered through Web Commerce Communications Limited on February 21, 2026, an anomalous creation date suggesting potential domain spoofing or backdating. It resolves to IP address 172.67.129.57 and is currently offline, though prior activity is confirmed. Detection metrics show 5 out of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on three security blocklists and is explicitly blocked by MetaMask, SEAL, and PhishDestroy. Technologies detected include jQuery, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, indicating a professionally hosted phishing infrastructure designed to evade basic detection. Mitigation requires immediate action from cryptocurrency users and security teams. Wallet holders should revoke any smart contract approvals associated with tezos-wallet.io via blockchain explorers or wallet interfaces. Security teams are advised to add the domain, IP 172.67.129.57, and associated indicators to blocklists and monitor for related infrastructure, such as similarly named domains or shared hosting patterns. Users should verify wallet interfaces exclusively through official sources and enable transaction simulation tools to preview smart contract interactions before execution. Due to the irreversible nature of blockchain transactions, proactive revocation of suspicious approvals is critical to preventing asset loss.