ocutowaltz[.]com

The domain ocutowaltz.com has been confirmed as a crypto credential theft site, designed to harvest wallet login credentials under the guise of professional trading services. Analysis indicates the site is currently offline, though prior activity suggests it operated as a fraudulent platform promising investment assistance to lure victims into disclosing sensitive authentication details for cryptocurrency wallets. Infrastructure analysis reveals the domain was registered on May 20, 2025, through GMO Internet Group, Inc. d/b/a Onamae.com, and resolved to the IP address 107.172.61.186. Detection metrics show the domain was flagged by 10 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on one security blocklist and was actively blocked by PhishDestroy. Technical indicators include the use of Bootstrap, LiteSpeed, SweetAlert, metisMenu, jQuery, JivoChat, Popper, and HTTP/3, suggesting a modern, interactive interface designed to mimic legitimate trading platforms. Given the elevated risk level and confirmed credential theft intent, organizations and individuals are advised to treat this domain as malicious. Network administrators should implement DNS-level blocking for 107.172.61.186 and ocutowaltz.com, while end-users should avoid interacting with any communications or links associated with the domain. Cryptocurrency holders are urged to verify the authenticity of trading services through official channels and enable multi-factor authentication on all wallet accounts to mitigate credential theft risks.