controls-x[.]com

This domain is flagged as a high-risk crypto drainer phishing site, designed to exfiltrate cryptocurrency wallet credentials and drain funds through malicious JavaScript injections. Analysis indicates the domain specifically targets users of decentralized finance platforms, employing fake wallet connection prompts to harvest private keys or seed phrases. The threat type is classified as a crypto drainer due to its direct financial impact on victims, with automated scripts executing unauthorized transactions upon credential compromise. Infrastructure analysis reveals the domain was registered on June 02, 2026, through GoDaddy.com, LLC, a registrar frequently abused for phishing operations. VirusTotal detection rates show 13 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The domain is currently offline, but its historical activity and registration patterns align with known crypto-focused phishing campaigns. No associated IP addresses or hosting providers were disclosed in available intelligence, though the rapid takedown suggests proactive mitigation by security entities. Mitigation requires immediate action from both users and network defenders. End users should revoke permissions for any suspicious wallet connections linked to controls-x.com and rotate seed phrases if exposure is suspected. Network-level protections include blocking the domain at DNS and proxy layers, as well as monitoring for outbound connections to known crypto drainer infrastructure. Organizations should prioritize retroactive scans for indicators of compromise, particularly in environments where cryptocurrency-related activities occur. Given the domain's high-risk classification, zero-trust policies should be enforced for all wallet interactions until the threat is fully neutralized.