webtrader[.]staplanyx-folinite[.]com

This domain operates as a crypto credential theft site, designed to harvest login details from users attempting to access cryptocurrency trading platforms. The site mimics legitimate Webtrader interfaces, tricking victims into entering sensitive account credentials, which are then captured by threat actors for unauthorized access or financial theft. Infrastructure analysis reveals the domain is actively targeting users seeking crypto trading services, with a focus on exploiting trust in established trading brands. Analysis indicates the domain was registered on June 15, 2026, through Tucows Domains Inc., an unusual creation date that may suggest domain spoofing or backdating. It resolves to the IP address 45.61.138.193 and is flagged by 9 out of 95 security vendors on VirusTotal, confirming malicious intent. The SSL certificate, issued by Sectigo Limited, is a Domain Validation (DV) type, which provides minimal identity verification and is commonly abused in phishing campaigns. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. If you visited webtrader.staplanyx-folinite.com, immediately revoke any sessions or credentials entered on the site. Monitor associated cryptocurrency wallets and trading accounts for unauthorized transactions. Reset passwords for any accounts accessed from the same device or network during the exposure period. Enable multi-factor authentication (MFA) on all financial and crypto-related accounts to mitigate further risk. Report the incident to relevant security teams or platforms to assist in broader threat mitigation efforts.