andafex[.]com

This domain is actively engaged in credential harvesting targeting cryptocurrency wallet users. Analysis of andafex.com reveals infrastructure designed to mimic legitimate wallet interfaces, likely prompting victims to enter private keys or recovery phrases under false pretenses. The page title 'FACKJX' appears to be a randomly generated placeholder, a common tactic to evade basic detection mechanisms while maintaining operational security during phishing campaigns. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on April 26, 2026, through Name SRS AB, with an unusually future creation date suggesting potential domain spoofing or registry manipulation. It currently resolves to 188.114.96.3 (Cloudflare, Inc. AS13335), a common hosting provider for malicious infrastructure due to its anonymization capabilities. The domain appears on 3 security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, with detection names including 'Phishing' and 'Fraudulent Website.' The SSL certificate is issued by Let's Encrypt (serial number E8), which, while legitimate, is frequently abused by threat actors to lend false credibility to phishing sites. Users who have visited andafex.com should immediately consider any credentials entered as compromised. If wallet access details, private keys, or recovery phrases were submitted, transfer all assets to a new wallet with a fresh seed phrase. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. The domain's continued operation despite blocklist inclusion suggests active campaign management; users should report the domain to their security providers and avoid interacting with any communications or redirects associated with this infrastructure. Network administrators should block the domain and IP at firewall level, and monitor for internal connections to 188.114.96.3, particularly from systems handling cryptocurrency operations.