wasabi-wallet[.]io

wasabi-wallet.io is flagged as a high‑risk crypto drainer domain. The site returns HTTP 200 and displays the generic page title "Default Web Site Page," indicating that no specific branding or content has been indexed. The domain was created on September 30, 2025 and is currently active, meeting the criteria for an operational malicious infrastructure.

Infrastructure analysis shows the domain resolves to IP address 66.29.137.92, which is registered to AS22612 Namecheap, Inc. and geolocated in the United States. The domain is registered through Dynadot LLC and uses the name servers dns1.namecheaphosting.com, dns1.web-hosting.com, and dns2.namecheaphosting.com. An SSL certificate issued by Sectigo Limited, signed by the Sectigo RSA Domain Validation Secure Server CA, is present, suggesting that the operators have secured HTTPS communication to increase credibility among potential victims.

Threat intelligence indicates that the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal has recorded a single positive detection out of 95 security vendors, and the Gridinsoft trust score is 0 out of 100, reflecting a strong consensus of malicious intent. These signals, combined with the high‑risk classification, provide concrete evidence that the domain is being used for cryptocurrency‑related fraud.

Defenders should add wasabi-wallet.io and its resolving IP 66.29.137.92 to network deny lists and configure web filtering solutions to block HTTP and HTTPS traffic to this host. Continuous monitoring for DNS queries to the associated name servers is advised, as changes in the underlying infrastructure may indicate campaign evolution. Given the active status and high‑risk rating, organizations handling cryptocurrency assets should treat any contact with this domain as a potential compromise and enforce strict verification procedures for any transaction requests linked to it.