kautax[.]com

This domain, kautax.com, operates as a crypto wallet drainer, a specialized phishing threat designed to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, the infrastructure automatically siphons funds by executing unauthorized transactions, often targeting popular wallets such as MetaMask, Trust Wallet, and Ledger Live. The threat is particularly insidious due to its use of social engineering tactics, such as fake token airdrops or wallet verification prompts, to trick users into authorizing transactions without their full awareness. Analysis of the domain’s behavior indicates it is part of a broader campaign leveraging cloned interfaces of legitimate crypto services to lower user suspicion and increase conversion rates. Evidence supporting the malicious classification of kautax.com includes detection by 19 out of 95 security vendors on VirusTotal, a clear indicator of widespread consensus among threat intelligence providers. The domain was registered on May 24, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with bulletproof hosting and low-cost domain registration services favored by threat actors. Additionally, the domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD, further corroborating its role in phishing operations. Infrastructure analysis reveals the domain resolves to the IP address 69.67.173.34, a hosting provider known for accommodating high-risk domains. The SSL certificate is issued by Let’s Encrypt, a common choice for phishing sites due to its free and automated issuance process, which allows threat actors to rapidly deploy encrypted connections to lend a false sense of legitimacy. Users who have interacted with kautax.com should immediately revoke any connected wallet permissions using a blockchain explorer or wallet management tool. This step is critical to prevent further unauthorized transactions, as lingering permissions can be exploited even after the initial phishing attempt. Affected users should also transfer remaining funds to a new, secure wallet and monitor their transaction history for any signs of unauthorized activity. If credentials or recovery phrases were entered on the site, these should be considered compromised, and all associated accounts or wallets should be migrated to new, secure alternatives. Given the high-risk nature of this threat, users are advised to report the domain to their wallet provider and relevant cybersecurity organizations to aid in broader mitigation efforts. Proactive measures, such as enabling transaction simulation tools and multi-factor authentication for wallet access, can reduce the risk of future compromise.