xolo[.]network

This domain, xolo.network, is flagged as a crypto wallet phishing site designed to harvest financial credentials and private keys. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used to impersonate legitimate cryptocurrency wallet services. No specific brand impersonation has been confirmed, but the infrastructure aligns with known phishing campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 190.115.18.115, which has been linked to other malicious activities. The domain appears on one security blocklist and is flagged by 6 of 95 security vendors on VirusTotal, indicating moderate but consistent detection. Additionally, it has been identified in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. The creation date, registrar choice, and hosting infrastructure collectively suggest a deliberate effort to evade detection while maintaining operational agility. As of the latest assessment, xolo.network has been taken offline, reducing immediate exposure risk. However, the domain’s infrastructure remains a latent threat, and similar domains may emerge using comparable tactics. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. End-users should verify the authenticity of any cryptocurrency wallet service by cross-referencing official sources and avoiding interaction with domains flagged by multiple security vendors. Continuous monitoring of related infrastructure is recommended, as threat actors may re-establish operations under new domains or IPs.