walletapi[.]exchangeeravitt[.]com

This domain is flagged as a high‑risk crypto drainer that masquerades as a cryptocurrency exchange. The site resolves to 2.57.91.189, an IP owned by Hostinger International Limited in Lithuania, and is served over HTTPS with a Let’s Encrypt certificate. The domain was registered on 24 Mar 2025 via GoDaddy and uses the parking‑service nameservers ns1.dns-parking.com and ns2.dns-parking.com. The page title returned by the HTTP 200 response is “Eravitt AI Token”, indicating an attempt to lure victims with a fabricated token offering. Front‑end assets are delivered through third‑party CDNs including Unpkg, jsDelivr, and Hostinger CDN, and the server supports HTTP/3. The domain appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal scans show 3 of 91 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. While the exact phishing page layout has not been analysed, the combination of a recently created domain, use of reputable CDN services to host malicious scripts, and the “Fake Exchange” classification suggests an intent to harvest crypto credentials or redirect funds. Defenders should immediately block network access to 2.57.91.189 and to walletapi.exchangeeravitt.com, add the domain to URL filtering and email security rules, and monitor for related subdomains or similar CDN usage patterns. Continuous threat‑intel feeds should be consulted for any emerging indicators, and any internal alerts referencing “Eravitt AI Token” or related transaction attempts should be investigated.