contractum[.]cc

This domain was actively involved in cryptocurrency credential phishing operations designed to harvest wallet login credentials and private keys. Victims were likely lured through deceptive links or fake wallet interfaces, where entered credentials would be captured and transmitted to threat actors for unauthorized access to digital assets. The site specifically targeted users of decentralized finance platforms and cryptocurrency wallets, exploiting trust in familiar-looking interfaces to facilitate theft. Analysis indicates contractum.cc was registered on March 01, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain resolved to IP address 104.21.19.167 and was protected by Cloudflare, utilizing HTTP/3 for enhanced performance and evasion. At the time of assessment, 3 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on three independent security blocklists. Despite displaying a 404 Not Found page, historical captures and infrastructure analysis confirm its use in phishing campaigns. If you visited contractum.cc or entered any credentials on a site resembling a cryptocurrency wallet, immediately disconnect the device from the internet and cease all financial transactions. Revoke any active wallet sessions and transfer assets to a new, secure wallet using a clean device. Scan the affected device with updated security tools to detect potential malware. Monitor all linked accounts for unauthorized activity and enable multi-factor authentication where available. Report the incident to relevant platform support teams and consider filing a report with local cybercrime authorities. Do not reuse passwords or recovery phrases associated with the compromised session.