wriggleimpex[.]com

This domain, wriggleimpex.com, is identified as a brand impersonation threat specifically targeting X.com, a high-profile social media platform. Analysis indicates the domain was designed to mimic legitimate X.com login portals or related services, likely to harvest user credentials, session tokens, or other sensitive authentication data. The page title 'Wriggle Impex Private Limited' suggests an attempt to lend superficial legitimacy, though no direct association with X.com or its parent entities exists. No explicit drainer kit signatures were observed in initial scans, but the domain's structure and behavior align with credential phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 29, 2019, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 103.149.165.49, geolocated in India under AS140155 (The Pinnacle Group Inc). At the time of assessment, VirusTotal reported 14 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, specifically PhishDestroy and PhishingDB, and is associated with a Let's Encrypt SSL certificate (R13). No detections were recorded on Google Safe Browsing at the time of this report. The domain is currently offline, having been taken down following detection and reporting. While the immediate threat has been mitigated, residual risk persists due to potential reuse of the infrastructure or registration of similar domains. Organizations and users are advised to monitor for domains with analogous naming patterns, particularly those combining generic business terms with social media branding. Network-level blocking of the IP 103.149.165.49 and domains registered through the same registrar during the same timeframe is recommended for proactive defense. End-users should verify domain authenticity before entering credentials, especially on pages mimicking X.com or other high-value platforms.