# users-wormhole.xyz — SUSPICIOUS

> users-wormhole.xyz is a Wormhole brand impersonation scam site with 0/95 VirusTotal detections. Check the full report.

## Summary
PhishDestroy identifies the domain users-wormhole.xyz as an active brand impersonation scam targeting Wormhole users. This domain is currently under investigation but remains accessible and operational, posing an immediate threat to unsuspecting visitors.  

This domain was flagged by 0 out of 95 VirusTotal vendors, indicating a near-zero detection rate despite its malicious intent. It is registered through Dynadot LLC, resolves to IP address 188.114.96.3, and was created on March 20, 2026. The SSL certificate was issued by Let's Encrypt, which could lend false legitimacy to the site. The domain exhibits no current blocklist presence, and trust scores remain unassessed due to its recent creation.  

Given the active status and low detection rate, immediate action is required to mitigate risk. Security teams are advised to block this domain at the network level, monitor for related infrastructure, and update threat intelligence feeds. Users should be warned against interacting with this domain and any associated services. Further analysis is ongoing to determine additional indicators of compromise and potential campaign scope.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Wormhole

## Domain Intelligence
- Registered: 2026-03-20 16:21:53
- Registrar: Dynadot LLC
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/7bfa7fab-8f50-4601-85d9-db759d87db3d
- PhishDestroy: https://phishdestroy.io/domain/users-wormhole.xyz/
- LLM endpoint: https://phishdestroy.io/domain/users-wormhole.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/users-wormhole.xyz/
Last updated: 2026-03-23