v60006[.]cc

This domain, v60006.cc, operates as a crypto wallet drainer, designed to harvest credentials and exfiltrate digital assets from unsuspecting users. The phishing page mimics legitimate wallet interfaces, tricking victims into entering private keys or seed phrases, which are then transmitted to attacker-controlled infrastructure. Analysis of the page title, 'V6,' suggests potential impersonation of a versioned or branded wallet service, though no direct brand correlation has been confirmed. Evidence supporting the malicious classification includes detection by 5 out of 95 security vendors on VirusTotal, placement on 3 distinct security blocklists, and registration through Gname.com Pte. Ltd. on June 09, 2026. The domain resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335), a common tactic to obscure origin and evade takedowns. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of legitimacy while failing to mitigate the underlying threat. Users who interacted with v60006.cc should immediately revoke any permissions granted to connected wallet applications and transfer remaining assets to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security teams. If credentials were entered, assume full compromise and avoid reusing passwords or seed phrases across platforms. Network administrators should block the domain and associated IP at the perimeter to prevent further exposure.