97ee3[.]catex[.]at

This domain, 97ee3.catex.at, is actively engaged in cryptocurrency phishing operations designed to steal wallet credentials and private keys. Visitors are typically lured through deceptive links promising token airdrops, wallet upgrades, or fake security alerts. Once accessed, the site presents a fraudulent interface mimicking legitimate wallet services, capturing sensitive login details or seed phrases entered by victims. The threat primarily targets users of decentralized finance platforms and digital asset holders, with infrastructure tailored to evade casual detection while maintaining persistence. Analysis indicates the domain is hosted on IP address 31.59.121.53 and secured with a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. It is flagged by 19 out of 95 security vendors on VirusTotal, including specialized blockchain security tools. The domain appears on two independent security blocklists and is actively blocked by multiple wallet protection systems. No legitimate creation date or registrar transparency is available, further suggesting its use in short-lived, high-velocity phishing campaigns rather than established services. If you have visited 97ee3.catex.at or entered any credentials, immediately disconnect the device from the network and cease all wallet interactions. Revoke any connected dApp permissions via your wallet interface and transfer assets to a new, secure wallet using a clean device. Monitor all linked accounts for unauthorized transactions and report the incident to relevant security teams. Do not reuse passwords or seed phrases from the compromised session, as attackers may retain access for future exploitation. Consider scanning the device for malware, as phishing sites may deploy additional payloads to maintain persistence.