lmsex[.]com

This domain is identified as part of a credential harvesting campaign specifically targeting users of cryptocurrency wallet interfaces. Analysis indicates the infrastructure was designed to mimic legitimate wallet login portals, capturing sensitive authentication details such as private keys, seed phrases, and account credentials. The domain employed social engineering tactics, including deceptive prompts and urgency-driven messaging, to coerce victims into disclosing confidential information. Infrastructure analysis reveals the domain lmsex.com was registered on March 25, 2026, through NameSilo, LLC, and resolved to the IP address 172.67.209.43. Detection metrics show the domain was flagged by 2 out of 95 security vendors on VirusTotal and appears on three distinct security blocklists. Additionally, the domain was referenced in one AlienVault OTX threat intelligence pulse, further corroborating its malicious intent. The domain has since been taken offline, though residual risk may persist for users who interacted with it prior to its deactivation. Users who visited lmsex.com or entered credentials on the site should immediately revoke any exposed wallet authorizations and transfer assets to a new, secure wallet. It is critical to monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Security teams are advised to update blocklists with the domain and associated IP address to prevent future access attempts. Victims should also report the incident to relevant financial and cybersecurity authorities to aid in broader mitigation efforts.