wanowex[.]com

PhishDestroy identifies wanowex.com as a domain under active investigation for hosting a generic phishing scam with a high likelihood of crypto theft. This domain does not impersonate a specific brand but exhibits classic drainer kit characteristics, including spoofed transaction interfaces designed to siphon funds from unwitting cryptocurrency users. The domain is suspected of hosting a fake login or transaction interface, commonly used by threat actors to harvest private keys or initiate unauthorized transfers from victim wallets. No specific drainer kit brand (e.g., Venom, Angel) has been confirmed at this stage, but the infrastructure aligns with known crypto-draining operations observed in recent campaigns targeting DeFi users.

Technical indicators for wanowex.com reveal a newly registered domain with concerning attributes: it was created on March 27, 2026, less than one month ago, and currently shows 4/95 detections on VirusTotal, indicating it is not yet widely flagged by security vendors. This domain resolves to IP address 172.67.159.180, which is associated with Cloudflare infrastructure, a common hosting provider for malicious domains due to its legitimate use masking malicious intent. The domain is registered through MAT BAO CORPORATION, a registrar known for low-cost bulk registrations that are often exploited in phishing campaigns. The SSL certificate is issued by Let’s Encrypt, a trusted provider, but this does not validate the site’s legitimacy. As of this report, Google Safe Browsing (GSB) has not yet flagged this domain, and no known blocklist counts are available, suggesting this threat is still in its early stages of propagation.

This domain remains under active investigation by PhishDestroy, with a current risk level classified as "under_investigation." Due to its recent creation and low detection rate, the risk to users is elevated, particularly for those interacting with cryptocurrency platforms or wallets. Immediate response actions include monitoring the domain for additional indicators of compromise (IOCs) and updating threat intelligence feeds to include IP 172.67.159.180 and domain wanowex.com. Users are advised to avoid interacting with this domain entirely until further analysis is complete. The remaining risk is moderate to high given the domain’s age, infrastructure, and lack of detections, warranting heightened caution for cryptocurrency-related activities.