cosmoswallet[.]org

This domain, cosmoswallet.org, operates as a brand impersonation site targeting users of the Cosmos blockchain ecosystem. The site presents itself as the legitimate "Cosmos Wallet | The Secure Gateway to the Interchain," but its primary function is to harvest cryptocurrency wallet credentials and private keys. Users who interact with the site risk immediate asset theft through crypto drainer scripts embedded in the fake login interface. The domain specifically impersonates "across," a known cross-chain protocol, increasing the likelihood of successful deception among users familiar with interchain services. Analysis indicates this domain is malicious based on multiple technical indicators. VirusTotal reports that 6 out of 95 security vendors detect the domain as malicious, with detections including phishing and credential theft classifications. The domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently used for short-lived phishing domains. Infrastructure analysis reveals the domain resolves to the IP address 85.17.55.181, which appears on three security blocklists. Additionally, the domain holds a Gridinsoft trust score of 0/100, further confirming its malicious nature. If you visited cosmoswallet.org or entered any credentials on the site, take immediate action to secure your assets. First, disconnect any connected wallets from the site using your wallet’s interface. Next, transfer all funds from the compromised wallet to a new, secure wallet with a fresh seed phrase. Monitor all connected accounts for unauthorized transactions and revoke any suspicious smart contract approvals using a blockchain explorer. Report the incident to your wallet provider and consider filing a report with relevant cybersecurity organizations to aid in tracking the threat actors. Do not reuse passwords or seed phrases associated with the compromised wallet.