roninwallet[.]io

This domain, roninwallet.io, is identified as a crypto drainer operation targeting users of the Ronin wallet, associated with the Axie Infinity blockchain gaming ecosystem. Analysis of the site reveals it employs a wallet-draining kit designed to trick victims into signing malicious transactions, which siphon cryptocurrency assets to attacker-controlled addresses. The page title, 'Welcome to Ronin – The Axie Infinity Wallet,' confirms the impersonation of the legitimate Ronin wallet service, increasing the likelihood of successful social engineering. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 188.114.96.3. Detection metrics indicate elevated risk, with 8 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by wallet security extensions and phishing detection systems. An SSL certificate issued by Google Trust Services provides a false sense of legitimacy, while the Gridinsoft trust score of 0/100 further corroborates its malicious nature. As of the latest assessment, roninwallet.io has been taken offline, reducing immediate exposure. However, the infrastructure remains a latent threat, as domains registered through the same registrar and resolving to similar IP ranges have been observed in recurring campaigns. Users who interacted with the site prior to its takedown should revoke any connected wallet permissions and monitor accounts for unauthorized transactions. The use of a unique seed identifier (37cabb) suggests this campaign may re-emerge under a different domain, necessitating continued vigilance among Axie Infinity and Ronin wallet users.