fiw9fksk-333[.]xyz

This domain, fiw9fksk-333.xyz, is identified as a high-risk credential harvesting site targeting cryptocurrency wallet users. The page impersonates Pepe.wtf, a legitimate platform, to deceive victims into entering sensitive authentication details, including private keys and recovery phrases. The fraudulent interface is engineered to exfiltrate credentials to attacker-controlled infrastructure, enabling unauthorized access to digital assets stored in wallets such as MetaMask and other browser-based or software wallets. Analysis indicates the domain was registered on May 03, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 185.111.111.155 and is flagged by 16 out of 95 security vendors on VirusTotal, with detection names including phishing, fraud, and cryptocurrency scam. It appears on three independent security blocklists and is explicitly blocked by MetaMask, PhishDestroy, and SEAL. Additionally, the domain has been documented in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. Technologies detected on the site include HSTS and Bunny, suggesting the use of content delivery networks to obfuscate hosting origins and enhance site availability. Users who visited fiw9fksk-333.xyz or interacted with its content should assume their wallet credentials have been compromised. Immediate actions include revoking all active sessions, transferring assets to a new wallet with a fresh seed phrase, and monitoring transaction histories for unauthorized activity. If private keys or recovery phrases were entered, the affected wallet should be considered fully compromised and abandoned. System scans using updated endpoint protection tools are recommended to detect potential secondary infections. Network administrators should block the domain and its resolving IP at the perimeter to prevent further exposure.