compasswallet[.]cc

The domain compasswallet.cc was registered on May 29, 2026 and currently resolves to the IPv4 address 111.90.148.49. The host resides in Malaysia and is announced by AS45839 Shinjiru Technology Sdn Bhd. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it is already flagged by PhishDestroy. The site returns HTTP 200 and presents a valid Let's Encrypt certificate (subject YE2). Infrastructure analysis shows the site is served by Nginx and built with a Node.js stack that includes React, Next.js, Webpack, and Google Analytics. The authoritative name servers are ns1.cloud-zero.net and ns2.cloud-zero.net. The page title observed in the response is "Connect Wallet | Compass Wallet", which mimics the interface of legitimate cryptocurrency wallet services. Threat intelligence classifies the site as a crypto drainer and generic phishing operation. VirusTotal records five positive detections out of ninety‑five scanned security vendors, indicating a modest but non‑trivial consensus of malicious behavior. The combination of a zero trust score, low‑reputation hosting, and a credential‑collection UI strongly suggests the site is designed to lure users into authorizing wallet transactions that transfer assets to attacker‑controlled addresses. Defenders should block both the domain and the associated IP address at the perimeter and add the host to internal blocklists. Monitoring for outbound connections to the IP and for attempts to resolve the domain can reveal compromised clients. Because the site uses a valid TLS certificate, deep packet inspection or TLS interception may be required to detect the malicious payload. Continuous review of VirusTotal updates and any new blocklist entries is advised, as the active status indicates the threat actor may still be operating.