voltx-ex[.]com

This domain, voltx-ex.com, is flagged as a high-risk cryptocurrency phishing site designed to harvest wallet credentials and private keys. Analysis indicates no direct association with a specific brand, though the naming convention suggests an attempt to mimic legitimate cryptocurrency exchange or wallet services. No confirmed drainer kit has been attributed to this domain at this time, but the infrastructure aligns with known phishing campaigns targeting decentralized finance (DeFi) users. The domain exhibits characteristics typical of credential theft operations, including the use of Cloudflare hosting to obscure origin servers and evade detection. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 16, 2026, through Name SRS AB, a registrar frequently observed in phishing operations. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists, including PhishDestroy and MetaMask. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on multiple blocklists suggests active malicious classification. As of the latest verification, voltx-ex.com remains active and continues to pose a significant risk to users. Response actions by security providers have included blocking the domain at the network and application layers, as evidenced by its inclusion in PhishDestroy and MetaMask denylists. However, the domain's continued resolution and lack of takedown indicate persistent operational status. Users are advised to avoid interaction with the domain and any associated links. Organizations should update internal blocklists to include this domain and its resolving IP address. Given the high-risk classification and active status, monitoring for related infrastructure or newly registered lookalike domains is recommended to mitigate further exposure.