geodnetreward[.]xyz

This domain, geodnetreward.xyz, is identified as a credential theft operation designed to harvest cryptocurrency wallet credentials under the guise of a reward program. Analysis indicates the site employs deceptive tactics, such as fake token distributions or airdrop claims, to trick users into entering sensitive wallet information, including private keys or seed phrases. Once obtained, these credentials enable attackers to drain funds from victim wallets, resulting in irreversible financial losses. The threat primarily targets users of decentralized finance (DeFi) platforms and crypto enthusiasts seeking promotional incentives. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, which is part of a network known for hosting phishing infrastructure. Detection metrics further confirm its malicious nature, with 6 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its use of Cloudflare services suggests an attempt to evade detection and analysis. The page title 'Just a moment...' is consistent with cloaking techniques used to delay or obscure malicious content from automated scanners. Users who visited geodnetreward.xyz should assume their wallet credentials or other sensitive information may have been compromised. Immediate action is required: disconnect any connected wallets from the site, revoke access to suspicious smart contracts, and transfer assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If private keys or seed phrases were entered, consider the associated wallet permanently compromised. Report the domain to relevant security communities and blocklist providers to prevent further victimization. Regularly update security tools and educate users on recognizing credential theft tactics in the crypto space.