waxpilusd[.]xyz

The domain waxpilusd.xyz has been identified as a host for credential theft activities targeting cryptocurrency users. The site, disguised under the page title 'WAXP', is likely attempting to deceive visitors into entering sensitive information which could be exploited for unauthorized access to cryptocurrency accounts. The risk associated with this domain is elevated due to its potential impact on financial assets.

Technical analysis shows significant indicators of malicious intent. This domain is flagged by 9 out of 95 security vendors on VirusTotal, indicating a concern within the cybersecurity community about its operations. It was registered through Gname.com Pte. Ltd. on December 29, 2025, showing a relatively recent establishment before being quickly flagged and subsequently taken offline. The domain appears on two known security blocklists, further emphasizing the threat it poses. Despite being offline, previous activity on this domain remains relevant to threat intelligence gathering and analysis.

Users who have interacted with waxpilusd.xyz are advised to immediately change any potentially compromised credentials and review their cryptocurrency account activity for unauthorized transactions. It is crucial to enable two-factor authentication wherever possible to add an additional layer of security. Remaining vigilant about similar deceptive domains and educating oneself on identifying phishing attempts can help mitigate risks in the future. Continued monitoring of related domains and IP addresses, such as 172.67.166.93, can provide further security insights into broader malicious activities.