injectivedesktop[.]org

Analysis indicates that www.injectivedesktop.org is an active malicious site that presents itself as the "Injective Desktop Wallet" according to its page title. The domain resolves to 216.150.1.1, an IP owned by Vercel, Inc. in the United States, and is served behind Cloudflare name servers (frank.ns.cloudflare.com, nia.ns.cloudflare.com). The site was registered on 25 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses a Let’s Encrypt R12 certificate with HSTS enabled. Automated scans report a Gridinsoft trust score of 0/100 and 7 of 94 VirusTotal scanners flag the domain as malicious. The infrastructure includes Vercel hosting and a LiveChat component, which is commonly abused for credential or private‑key harvesting. The classification as a "Crypto Drainer" suggests the site attempts to trick users into submitting wallet credentials or signing transactions that transfer funds to an attacker‑controlled address. Current evidence is limited to the page title and infrastructure metadata; the exact phishing flow, malicious payloads, or compromised accounts have not been publicly disclosed. Defensive actions should include adding www.injectivedesktop.org and its resolving IP 216.150.1.1 to deny‑list rules, updating IDS/IPS signatures to detect HTTP 200 responses from this host, and monitoring for outbound blockchain transaction attempts originating from internal endpoints. Continuous threat‑intel feeds should be consulted for any new indicators of compromise, and any user reports of unauthorized wallet activity should be investigated promptly.