qwjiv[.]com

PhishDestroy identifies qwjiv.com as an active site running a credential theft campaign disguised as an NFT seeding tool, luring users with fake minting opportunities. The domain was registered through Hefei Juming Network Technology Co., Ltd on May 10, 2024 and resolves to 54.230.183.58, showing no detections at VirusTotal as of the latest scan (0/95). The use of an Amazon-issued SSL certificate adds false legitimacy, a common tactic to trick users into entering wallet credentials or seed phrases.

Technical analysis reveals this domain is part of a broader campaign targeting NFT enthusiasts, leveraging urgency and exclusivity to prompt quick action. With zero detections on VirusTotal and no prior reportage, the threat remains undetected by most automated systems, increasing the risk to early victims. The domain’s creation date aligns with an uptick in similar campaigns, suggesting coordination among threat actors.

If you or someone you know has visited qwjiv.com and entered any credentials, seed phrases, or wallet information, immediately revoke access to all connected wallets and transfer assets to a new, secure wallet. Scan devices for malware using reputable security software and enable two-factor authentication on all crypto accounts. Report the incident to your wallet provider and consider filing a report with local cybercrime units or platforms like the FBI’s IC3. Always verify URLs and project legitimacy through official channels before engaging.