wallxnet[.]cm-at[.]sbs

This domain is flagged for elevated-risk generic phishing activity specifically targeting cryptocurrency wallet credentials. Analysis indicates it operates as a fake wallet interface designed to harvest seed phrases, private keys, or login credentials under the guise of legitimate wallet services. The threat type aligns with crypto drainer tactics, where victims are tricked into entering sensitive information that enables unauthorized fund transfers. Infrastructure analysis reveals the domain wallxnet.cm-at.sbs was registered on October 27, 2025, through NameSilo, LLC. It resolves to the IP address 198.23.196.133 and is currently offline. Security vendors on VirusTotal flagged the domain at a detection rate of 17/95. It appears on two security blocklists and has a Gridinsoft trust score of 0/100. Technologies detected include Nginx and HSTS, suggesting efforts to mimic secure connections while facilitating credential theft. Mitigation requires immediate action from security teams and end users. Network-level blocking should be enforced for the domain and its associated IP 198.23.196.133. Organizations should update endpoint protection rules to flag or quarantine any attempts to access wallxnet.cm-at.sbs. Users who may have interacted with the domain must revoke wallet permissions, transfer assets to new wallets, and monitor transaction histories for unauthorized activity. Cryptocurrency services should issue alerts to users about this specific phishing campaign, emphasizing verification of domain authenticity before entering credentials.