wasabi-desktopapp[.]live

This domain, wasabi-desktopapp.live, is under investigation for operating as a fraudulent cryptocurrency wallet application designed to execute crypto drainer attacks. The site impersonates the legitimate Wasabi Wallet by presenting itself as a desktop application download portal, using the page title 'Wasabi Wallet — Now on Desktop.' Such schemes typically aim to trick users into downloading malicious software that siphons cryptocurrency from connected wallets by exploiting weak or compromised authentication mechanisms. The threat is particularly insidious given the irreversible nature of blockchain transactions and the high value of digital assets targeted. Analysis of the domain reveals multiple technical indicators supporting its classification as malicious infrastructure. The domain was registered on June 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 216.198.79.1, hosted on AS16509 (Amazon.com, Inc.), a common cloud provider leveraged for both legitimate and malicious operations. As of the latest assessment, the domain has not been flagged by antivirus engines, with a VirusTotal detection score of 0/95. However, it appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate, issued by Let's Encrypt (serial number YR2), provides encryption but does not validate the legitimacy of the site, a tactic often exploited in phishing campaigns to appear trustworthy. Users who have visited wasabi-desktopapp.live or downloaded files from the site should take immediate remedial action. Disconnect any devices that interacted with the domain from the internet to prevent further data exfiltration. Scan the affected system using updated security tools to detect and remove any malicious payloads. If cryptocurrency wallets were accessed or credentials entered, assume compromise and transfer remaining assets to a new, secure wallet using a clean device. Monitor all linked accounts for unauthorized transactions and revoke access to any suspicious applications or browser extensions. Given the domain's recent registration and lack of widespread detection, heightened vigilance is advised, particularly for users in the cryptocurrency ecosystem.