spacexaiwallet[.]net

spacexaiwallet.net is actively operating as a crypto drainer impersonating SpaceX’s AI wallet infrastructure. Threat intelligence confirms active delivery campaigns distributing malicious JavaScript payloads to harvest cryptocurrency wallet credentials and private keys. The domain leverages brandjacking to lure victims into connecting their wallets under the guise of an exclusive SpaceX AI wallet airdrop or ecosystem integration. As of today, this threat remains live with no evidence of takedown or mitigation.

PhishDestroy identifies spacexaiwallet.net as a crypto drainer with elevated risk status. The domain was registered on April 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 172.67.186.12 and is protected by a Let’s Encrypt SSL certificate. Security vendor analysis reveals a detection ratio of 3 out of 95 engines on VirusTotal, indicating limited but present visibility among threat intelligence platforms. No current inclusion on major blocklists or threat feeds was detected during the latest scan cycle, resulting in neutral trust scores across most cybersecurity reputation databases.

Threat monitoring indicates active propagation through social engineering channels, particularly targeting tech enthusiasts and cryptocurrency investors with promises of early access to AI-powered SpaceX wallet tools. While the IP and domain infrastructure show low blocklist coverage, the combination of active SSL usage, recent registration, and crypto-drainer payload design elevates operational risk. Organizations and individuals are strongly advised to block inbound and outbound traffic to spacexaiwallet.net at the network perimeter. Users should ignore unsolicited communications referencing SpaceX AI wallets and verify wallet URLs via official SpaceX domains only. Conduct emergency wallet audit, revoke suspicious connections, and deploy EDR rules to detect anomalous Web3 transaction initiations involving known drainer scripts.