wazterik[.]online

This domain, wazterik.online, is identified as a crypto wallet drainer phishing site targeting users through fraudulent wallet connection prompts. Analysis indicates no direct brand impersonation, but the domain employs standard drainer kit tactics, including fake transaction authorization interfaces designed to exfiltrate private keys or seed phrases. The infrastructure lacks overt branding, suggesting a generic or opportunistic phishing campaign rather than a targeted impersonation of a specific cryptocurrency service or exchange. Technical indicators confirm elevated risk: the domain is flagged by 12 out of 95 security vendors on VirusTotal, with detection signatures including phishing, malicious URL, and cryptocurrency fraud categories. Registered through Unstoppable Domains, Inc. on February 21, 2026, the domain resolves to IP address 45.9.148.51, hosted on AS49447 (Nice IT Services Group Inc., Netherlands). The SSL certificate is issued under the common name 8102be99.as49447.net, associated with a Hestia Control Panel instance. The domain appears on one security blocklist, and no entries were found in Google Safe Browsing at the time of analysis. The creation date discrepancy (2026) suggests potential domain squatting or falsified registration data. Current status shows the domain as offline, likely following takedown or suspension by the hosting provider or registrar. However, residual risk remains due to the domain's registration persistence and the potential for reactivation or migration to alternative infrastructure. Users who interacted with the site should assume credential or wallet compromise and take immediate action: revoke all connected dApp authorizations, transfer assets to a new wallet, and monitor for unauthorized transactions. Network defenders are advised to block the domain, IP, and associated SSL certificate at perimeter controls and update detection rules to include the domain's known indicators.