kuyoxatapex[.]net

This domain, kuyoxatapex.net, is identified as a high-risk crypto wallet drainer phishing site designed to steal cryptocurrency credentials and drain digital assets from victims. The domain is currently offline, though its infrastructure remains a documented threat. Analysis indicates the site specifically impersonates legitimate cryptocurrency wallet services to deceive users into entering private keys or seed phrases, enabling unauthorized access to their funds. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, and resolved to the IP address 123.123.123.123, hosted on AS4808 within China Unicom’s Beijing Province Network. Security vendors on VirusTotal flagged the domain as malicious, with 10 out of 95 engines detecting it as a phishing threat. The domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. No SSL certificate was present, further reducing its legitimacy and increasing its risk profile. Google Safe Browsing also classified the domain as a phishing site prior to its takedown. At present, kuyoxatapex.net is offline, though historical data and threat indicators remain relevant for security teams and end-users. Organizations are advised to block the domain and its associated IP address at the network level to prevent potential re-emergence. Users who may have interacted with the site should immediately revoke access to any connected cryptocurrency wallets, transfer remaining assets to a new wallet, and monitor accounts for unauthorized transactions. Security teams should treat this domain as a confirmed malicious entity and include it in threat intelligence feeds for ongoing monitoring. Proactive measures, such as educating users on recognizing phishing attempts and verifying domain authenticity, are critical to mitigating similar threats.