mathjp[.]net

This domain, mathjp.net, is flagged as a generic phishing site specializing in Web3 wallet credential theft. Analysis of the page title, 'Web3 Wallet Login,' indicates an intent to deceive users into entering private keys or seed phrases, likely for cryptocurrency wallets such as MetaMask, Trust Wallet, or other decentralized finance (DeFi) platforms. No specific drainer kit signature has been identified, but the domain follows common phishing tactics used in cryptocurrency theft campaigns, including impersonation of legitimate wallet interfaces and the use of Let's Encrypt SSL certificates to appear trustworthy. Technical indicators confirm elevated risk. The domain was registered on November 21, 2025, through Dynadot LLC, and resolves to the IP address 185.18.222.225. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on 2 security blocklists, including entries from ScamSniffer and PhishDestroy. No Google Safe Browsing (GSB) hits are currently recorded, though this may reflect a lag in detection rather than absence of malicious activity. As of the latest assessment, mathjp.net has been taken offline, reducing immediate exposure. However, the infrastructure remains a residual risk. The IP address 185.18.222.225 has been associated with other phishing domains in the past, suggesting potential reuse for future campaigns. Users who interacted with the site should assume credential compromise and take immediate action, including revoking wallet permissions, transferring assets to new wallets, and monitoring for unauthorized transactions. Organizations should update blocklists to include the domain and IP, and monitor for related domains registered through the same registrar or hosted on the same infrastructure.