ScanMalware.com
Known malicious kithighphishing

rwusdt/axex/safe Crypto Wallet Impersonation — chunk-vendors

family: rwusdt-axex-safe-e232

Operator running multi-brand crypto-wallet impersonation across 17 hosts: rwusdtc[a-y].com (USDT impersonation), axexclub/axexhub on .com+.top, safeger/safegnr/safetar.com, plus dbecrede.com, exintir.com. Fake-wallet credential harvesting.

Fingerprint anchors

content sha25672e50786bc5e7149737ff0a66fdf397a7fa94fc0b8cb5097abfc942e7fad88ec
canonical ASTe2322b1c7fa3e7001eb2e2418c5b693af890350322cd4487c333e02e896905f6
TLSHT1BF15198DB281B0B60BE760B1403F220BB23B6959B80A95D4F675E4E46D78D8D5237F7C

Provenance

Added by: analyst
Added: 2026-05-26 16:48
17 hosts. rwusdt[a-y].com USDT-wallet impersonation + axex/safe brand cohorts.

Sightings (20)

HostScanScriptMatchWhen
dbecrede.com8f864d26…https://dbecrede.com/static/js/chunk-vendors.8304e2e9.jsbyte2026-05-25 02:22
axexhub.top461cd2e8…https://axexhub.top/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 10:46
axexhub.com2f1b48aa…https://axexhub.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 10:46
axexhub.com3507eb92…https://axexhub.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 10:41
axexclub.com91198e10…https://axexclub.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 10:06
axexclub.topbc9ffac9…https://axexclub.top/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 09:54
axexclub.com494ce43e…https://axexclub.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 09:49
axexclub.top97fd6b07…https://axexclub.top/static/js/chunk-vendors.ea075875.jsbyte2026-05-24 09:46
rwusdtco.comab83b521…https://rwusdtco.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:37
rwusdtcy.com889bfa88…https://rwusdtcy.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:31
rwusdtca.com2c5ce16a…https://rwusdtca.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:27
rwusdtcl.com6f1d36ba…https://rwusdtcl.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:24
rwusdtcd.coma40ed678…https://rwusdtcd.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:19
rwusdtcn.com6e7bb11e…https://rwusdtcn.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:14
rwusdtce.com0d4fcca0…https://rwusdtce.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 06:00
rwusdtcm.comc0a2e458…https://rwusdtcm.com/static/js/chunk-vendors.61332e96.jsbyte2026-05-24 05:59
safegnr.comd652a05e…https://safegnr.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-23 23:41
safetar.com554fdc42…https://safetar.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-23 22:09
safeger.com9e6ac07f…https://safeger.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-23 22:05
exintir.comea2f66d0…https://exintir.com/static/js/chunk-vendors.ea075875.jsbyte2026-05-23 07:42