wuas03[.]top

This domain, wuas03.top, is identified as an active phishing infrastructure targeting cryptocurrency users through the impersonation of PMCYBIT wallet services. Analysis indicates the site is designed to harvest login credentials, private keys, or seed phrases under false pretenses, posing a direct financial threat to visitors. The domain remains operational and unmitigated as of the latest verification. Infrastructure analysis reveals the domain was registered on April 13, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 172.67.211.39, hosted on Cloudflare’s network (AS13335). Security telemetry shows the domain appears on three distinct blocklists, while VirusTotal reports detection by 2 of 95 security vendors. The SSL certificate is issued by Let’s Encrypt (serial YE1), a common practice among threat actors to mimic legitimate encryption standards. The page title, PMCYBIT, directly corresponds to the targeted brand, reinforcing the impersonation vector. Current monitoring confirms wuas03.top remains active and accessible. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Endpoint protection systems should be updated to include this indicator of compromise, and users should be alerted to avoid interaction with the site. Given the domain’s registration date discrepancy (future-dated), further scrutiny of the registrar’s abuse handling procedures is recommended for potential enforcement action.