digibytedesktop[.]org

The domain digibytedesktop.org has been identified as a phishing site specifically targeting cryptocurrency users through the impersonation of the DigiByte Desktop wallet application. Analysis confirms this infrastructure is designed to harvest wallet credentials or deploy crypto drainer scripts, a high-risk threat vector for digital asset theft. The domain is currently offline, though prior activity suggests it may resurface under similar naming conventions. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Dynadot Inc., an uncommon future-dated creation that may indicate registration system manipulation or intentional obfuscation. It resolves to the IP address 45.33.124.141 and employs a Let's Encrypt SSL certificate, creating a false sense of legitimacy. Detection metrics show the domain was flagged by 2 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The site appears on one security blocklist and was previously blocked by PhishDestroy. Technical fingerprinting detected Node.js, Ubuntu, Nginx, and Express on the backend, with frontend frameworks including Bootstrap and embedded YouTube content likely used to enhance social engineering credibility. Current status indicates the domain has been taken offline, though the underlying infrastructure remains a persistent threat. Organizations and individuals are advised to proactively block the domain and associated IP at network perimeters. Cryptocurrency users should verify all wallet software downloads exclusively through official DigiByte channels and enable multi-factor authentication where available. Security teams should monitor for similar domain registrations using the 'digibyte' brand name combined with terms like 'desktop,' 'wallet,' or 'app,' particularly those registered through Dynadot or resolving to the same IP range. Future investigations should examine historical WHOIS records for additional connected infrastructure.