ScanMalware.com
Known malicious kithighphishing

rwusdt/axex/safe Crypto Wallet Impersonation — chunk-vendors

family: rwusdt-axex-safe-e232
Short link:scanmalware.com/h/35

Operator running multi-brand crypto-wallet impersonation across 17 hosts: rwusdtc[a-y].com (USDT impersonation), axexclub/axexhub on .com+.top, safeger/safegnr/safetar.com, plus dbecrede.com, exintir.com. Fake-wallet credential harvesting.

Anchors

content sha25672e50786bc5e7149737ff0a66fdf397a7fa94fc0b8cb5097abfc942e7fad88ec
canonical ASTe2322b1c7fa3e7001eb2e2418c5b693af890350322cd4487c333e02e896905f6
TLSHT1BF15198DB281B0B60BE760B1403F220BB23B6959B80A95D4F675E4E46D78D8D5237F7C

Provenance

Added: 2026-05-26 16:48
17 hosts. rwusdt[a-y].com USDT-wallet impersonation + axex/safe brand cohorts.

Sightings (26)Atom feed

HostScanScriptMatchScanned
zevrmlae.comb80f6188…https://zevrmlae.com/static/js/chunk-vendors.c92c0be3.jsbyte2026-09-17 14:36
franklinersd.comc1c8b092…https://franklinersd.com/static/js/chunk-vendors.a3b6c819.jsbyte2026-09-07 12:58
rwusdtmasen.com1429a5b2…https://rwusdtmasen.com/static/js/chunk-vendors.61332e96.jsbyte2026-08-10 10:38
vexorpxmue.com0185f933…https://vexorpxmue.com/static/js/chunk-vendors.708276a4.jsbyte2026-08-02 12:11
vexorpxmue.comf481062e…https://vexorpxmue.com/static/js/chunk-vendors.708276a4.jsbyte2026-07-30 02:34
vexorevkzb.com637f0d94…https://vexorevkzb.com/static/js/chunk-vendors.708276a4.jsbyte2026-07-23 15:09
dbecrede.com8f864d26…https://dbecrede.com/static/js/chunk-vendors.8304e2e9.jsbyte2026-05-22 00:13
axexhub.top461cd2e8…https://axexhub.top/static/js/chunk-vendors.ea075875.jsbyte2026-03-02 11:35
axexhub.com2f1b48aa…https://axexhub.com/static/js/chunk-vendors.ea075875.jsbyte2026-03-02 11:12
axexhub.com3507eb92…https://axexhub.com/static/js/chunk-vendors.ea075875.jsbyte2026-03-02 05:50
axexclub.com91198e10…https://axexclub.com/static/js/chunk-vendors.ea075875.jsbyte2026-03-01 14:43
axexclub.topbc9ffac9…https://axexclub.top/static/js/chunk-vendors.ea075875.jsbyte2026-02-28 14:25
axexclub.com494ce43e…https://axexclub.com/static/js/chunk-vendors.ea075875.jsbyte2026-02-28 11:15
axexclub.top97fd6b07…https://axexclub.top/static/js/chunk-vendors.ea075875.jsbyte2026-02-28 05:03
rwusdtco.comab83b521…https://rwusdtco.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-10 08:20
rwusdtcy.com889bfa88…https://rwusdtcy.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-08 05:43
rwusdtca.com2c5ce16a…https://rwusdtca.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-07 17:32
rwusdtcl.com6f1d36ba…https://rwusdtcl.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-07 07:30
rwusdtcd.coma40ed678…https://rwusdtcd.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-06 14:49
rwusdtcn.com6e7bb11e…https://rwusdtcn.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-05 12:23
rwusdtce.com0d4fcca0…https://rwusdtce.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-03 18:50
rwusdtcm.comc0a2e458…https://rwusdtcm.com/static/js/chunk-vendors.61332e96.jsbyte2026-02-03 15:21
safegnr.comd652a05e…https://safegnr.com/static/js/chunk-vendors.ea075875.jsbyte2026-01-12 01:11
safetar.com554fdc42…https://safetar.com/static/js/chunk-vendors.ea075875.jsbyte2026-01-08 04:55
safeger.com9e6ac07f…https://safeger.com/static/js/chunk-vendors.ea075875.jsbyte2026-01-07 22:38
exintir.comea2f66d0…https://exintir.com/static/js/chunk-vendors.ea075875.jsbyte2026-01-01 14:06