maintenance-x[.]net

This domain, maintenance-x.net, is identified as a high-risk phishing infrastructure targeting cryptocurrency users through a wallet drainer scheme. Analysis indicates the domain impersonates maintenance or support pages for crypto wallets, tricking victims into connecting their wallets to malicious smart contracts designed to siphon funds. No specific brand impersonation is confirmed, but the domain follows a pattern consistent with generic crypto drainer kits, likely leveraging social engineering tactics such as fake security alerts or upgrade prompts to deceive users.

Technical indicators reveal the domain was registered on May 14, 2026, through OVH sas, a registrar frequently abused for phishing operations. It resolves to the IP address 213.186.33.5, hosted by OVH SAS in France. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The domain lacks an SSL certificate, a red flag for phishing sites, and is not listed in Google Safe Browsing at the time of analysis. Infrastructure analysis further reveals the domain was taken offline shortly after detection, suggesting a reactive measure by the hosting provider or registrar.

Current status indicates the domain is offline, reducing immediate risk to end users. However, the infrastructure remains a latent threat due to the domain's recent registration and association with known phishing patterns. Response actions by security providers, including blocking by PhishDestroy, MetaMask, and SEAL, have mitigated exposure, but residual risk persists for users who may have interacted with the domain prior to takedown. Users are advised to verify wallet connections, revoke access to suspicious smart contracts via wallet interfaces, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.