viada[.]xyz

This domain is flagged as an elevated-risk cryptocurrency wallet phishing site targeting users through deceptive interfaces. Analysis indicates the infrastructure was designed to harvest wallet credentials, private keys, or seed phrases by impersonating legitimate cryptocurrency services, specifically Axiom, as evidenced by the page title and detected frontend technologies. Infrastructure analysis reveals viada.xyz resolves to IP address 172.67.171.214 and appears on three security blocklists, including MetaMask, PhishDestroy, and SEAL. The domain was registered on March 7, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline. VirusTotal reports 4 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 47/100. Detected technologies include Node.js, Vue.js, Nuxt.js, Cloudflare Browser Insights, Cloudflare, and HTTP/3, suggesting a modern, obfuscated phishing framework leveraging content delivery networks for resilience. Mitigation requires immediate action from cryptocurrency users and security teams. Users should verify wallet addresses via official sources before transactions and revoke access to any suspicious browser extensions or dApps linked to this domain. Security teams should block the domain and IP at the network level, monitor for related subdomains or typosquatting variants, and update endpoint protection rules to detect Node.js-based phishing frameworks. Wallet providers should preemptively warn users about this campaign and encourage hardware wallet adoption for sensitive operations.