redmont-group[.]com[.]interactive-tradex[.]com

This domain, redmont-group.com.interactive-tradex.com, is identified as a crypto credential theft infrastructure targeting users of decentralized finance platforms. Analysis indicates the site is designed to harvest wallet credentials, likely through spoofed login interfaces or fake token airdrop claims. No explicit brand impersonation is confirmed, but the structure mimics legitimate crypto service portals, increasing the likelihood of successful deception. The absence of a known drainer kit signature suggests a custom or obfuscated payload, which may evade basic detection mechanisms. Infrastructure analysis reveals the domain was registered on April 06, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with high-risk registrations. It resolves to the IP address 198.251.89.220, a host with a history of malicious activity. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on four security blocklists, including MetaMask and PhishDestroy, and is categorized as an elevated-risk threat. Google Safe Browsing (GSB) status is not explicitly provided, but the blocklist presence aligns with active malicious classification. The domain is currently offline, reducing immediate exposure risk. However, historical data and registrar patterns suggest potential for rapid redeployment under a new domain or subdomain. Users who interacted with this domain prior to takedown should assume credential compromise and take immediate action: revoke wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and IP, and conduct retrospective log analysis to identify any prior interactions. Remaining risk includes the possibility of attacker-controlled infrastructure resurfacing with updated tactics.