stealthexi[.]org

The domain stealthexi.org was identified as a phishing site conducting brand impersonation targeting the 'across' brand. The site presented itself with the page title 'StealthEX: Anonymous Crypto Exchange' and was associated with wallet_connect_phish scams. As of now, stealthexi.org has been taken offline and is no longer accessible, but it previously posed an elevated risk to users seeking legitimate crypto exchange or wallet services.

Technical analysis shows that stealthexi.org was flagged by 2 of 95 security vendors on VirusTotal, specifically ADMINUSLabs and Fortinet. The domain was created on February 21, 2026, and resolved to the IP address 2606:4700:3036::6815:4a20, which is located in the US under AS13335 (Cloudflare, Inc.). The SSL certificate was issued by WE1. Stealthexi.org appears on one security blocklist (PhishDestroy), but is not flagged by Google Safe Browsing. The registrar information is not available.

Individuals who interacted with stealthexi.org, especially through wallet connection features, should immediately revoke any token approvals and transfer their assets to a new wallet to mitigate the risk of crypto theft. Users who entered credentials should change their passwords, enable two-factor authentication, and monitor accounts for unauthorized activity. Suspected phishing or scam activity related to stealthexi.org can be reported to security blocklists such as PhishDestroy and relevant authorities.