wojakcto[.]info

The domain wojakcto.info has been identified as a generic phishing threat targeting users of the $WOJAK cryptocurrency project. This site was set up to impersonate a legitimate migration portal, likely to steal wallet credentials or private keys through a drainer kit. The domain was created on February 22, 2026, and registered through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains. Its SSL certificate was issued by Let's Encrypt (E8), which provides a false sense of security.

Technical analysis shows that VirusTotal flagged this domain with a score of 6 out of 95 security vendors, indicating significant malicious activity. The domain resolves to IP address 185.218.16.135 and appears on 3 security blocklists. Google Safe Browsing (GSB) status is not explicitly mentioned but the domain's inclusion on blocklists suggests it has been actively detected. The page title was found to be "$WOJAK Migration Portal", confirming the phishing narrative.

Currently, wojakcto.info is offline, likely taken down after security reports. However, the risk remains as similar domains may reappear. Users who interacted with this site should immediately change any passwords used and monitor their cryptocurrency wallets for unauthorized transactions. PhishDestroy advises avoiding any unsolicited migration portals and always verifying URLs through official project channels. Remaining vigilance is crucial as the threat actors behind this campaign may deploy new domains.