wallet-j2tx-staging[.]finam[.]dev

This domain, wallet-j2tx-staging.finam.dev, operates as a crypto drainer, a type of malicious infrastructure designed to siphon cryptocurrency assets from compromised wallets. Analysis indicates the domain is engineered to harvest wallet credentials through deceptive interfaces, likely mimicking legitimate wallet services or staging environments. Once credentials are obtained, the threat actor can execute unauthorized transactions, transferring assets to attacker-controlled addresses without user consent. The technical implementation includes obfuscated scripts and wallet interaction handlers, typical of crypto drainer operations observed in recent campaigns. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 3 out of 95 security vendors on VirusTotal, including detections for malicious or phishing-related activity. Registered through Regional Network Information Center, JSC (RU-CENTER) on February 21, 2026, the domain resolves to the IP address 78.41.195.145. It appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt, does not mitigate the inherent risk. The domain was taken offline, but its prior activity and technical configuration align with known crypto drainer infrastructure. Technologies detected include HSTS, Google Analytics, and HTTP/3, which may be leveraged to enhance obfuscation or track victim interactions. Users who visited wallet-j2tx-staging.finam.dev should assume potential exposure of wallet credentials or interaction with malicious scripts. Immediate actions include disconnecting any wallets linked to the domain, revoking active session approvals, and transferring assets to a new, secure wallet. Monitor transaction histories for unauthorized activity and report any suspicious transfers to the respective blockchain explorer or wallet provider. If credentials were entered, consider the original wallet compromised and avoid reusing passwords or seed phrases. Review connected applications and revoke permissions for any unknown or suspicious services. Given the elevated risk level, affected users should also scan their devices for malware to rule out secondary infections.