koazox[.]com

The domain koazox.com has been identified as a crypto drainer operation, designed to compromise digital wallets and siphon cryptocurrency assets. Analysis indicates the site is currently offline, though prior activity targeted users through deceptive wallet connection prompts and malicious smart contract interactions. No legitimate brand affiliation or service offering was detected during investigation. Infrastructure analysis reveals the domain was registered on May 18, 2026, through Fewmoretaps OU d/b/a Trustname.com, an entity frequently associated with high-risk registrations. It resolved to IP address 69.67.173.34 and was protected by a Let's Encrypt SSL certificate, a common tactic to appear legitimate. The domain is flagged by 19 of 95 security vendors on VirusTotal and appears on five distinct security blocklists, including MetaMask and ScamSniffer. Additional indicators include a Gridinsoft trust score of 1/100 and detection in one AlienVault OTX threat intelligence pulse. Technologies detected on the infrastructure include Cloudflare and HTTP/3, which may have been used to obfuscate malicious traffic or evade detection. As of the latest verification, koazox.com has been taken offline, though residual risk remains for users who may have interacted with the domain prior to its deactivation. Security teams are advised to add the domain and associated IP to blocklists, monitor for wallet addresses linked to the operation, and review logs for connections to 69.67.173.34. Users should revoke any smart contract approvals granted to unknown or suspicious domains and verify wallet security. Organizations are encouraged to update detection rules to include this domain and its indicators in future threat hunting activities.