cimoxen[.]co[.]com

The domain cimoxen.co.com is identified as a cryptocurrency wallet impersonation scam, specifically targeting users with a fraudulent hardware wallet interface. Analysis indicates this domain is designed to deceive victims into entering recovery phrases or private keys, enabling crypto asset theft. As of the latest verification, the domain has been taken offline, though prior activity remains a confirmed threat. Infrastructure analysis reveals the domain was registered through Moniker Online Services LLC and resolved to the IP address 89.124.64.250. It appears on three security blocklists and is flagged by 2 of 95 VirusTotal vendors. The site used a Let's Encrypt SSL certificate and displayed the page title 'Holdexer - Secure Hardware Wallet for Cryptocurrency,' mimicking legitimate wallet providers. Additional trust indicators include a Gridinsoft trust score of 0/100 and explicit blocking by MetaMask, SEAL, and PhishDestroy. Given the domain's current offline status, no active threat is present; however, historical indicators confirm malicious intent. Users are advised to verify wallet interfaces against official sources before entering sensitive information. Any prior interaction with this domain should prompt immediate revocation of wallet access and a review of connected accounts for unauthorized transactions. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range.