walletwasabi[.]com

walletwasabi.com has been identified as a crypto drainer posing as the legitimate Wasabi Wallet service. The domain employs a phishing strategy to trick users into connecting their wallets and authorizing malicious transactions. Security research indicates this domain leverages a drainer kit designed to siphon cryptocurrency assets under the guise of a legitimate service. The operation targets users familiar with Wasabi Wallet, exploiting brand recognition to enhance credibility and deceive victims. This domain was registered through TUCOWS.COM, CO. on September 25, 2025, and resolves to the IP address 216.198.79.1. VirusTotal currently flags this domain with a detection score of 1 out of 95 security vendors, indicating low initial visibility among security tools. The certificate authority behind the SSL certificate is Let's Encrypt, which does not inherently indicate malicious intent but is commonly abused by threat actors. The domain has not been flagged by Google Safe Browsing (GSB) at this time, and further blocklist enrichment is recommended to assess additional exposure. As of the latest analysis, walletwasabi.com remains active and operational, with no observed takedown or mitigation efforts. Immediate action is recommended to block this domain at the network perimeter and alert users to avoid interacting with it. Despite its low initial detection rate, the elevated risk stems from its targeted approach and the potential for significant financial loss. Continued monitoring is advised as this campaign may evolve or expand to additional infrastructure.