Cybercriminals operated a coordinated scam infrastructure hosting fake cryptocurrency sites, a malicious browser-extension-based wallet-connect phishing flow, and an iPhone configuration-profile phishing “app” that together enabled wallet drains and credential theft. Key infrastructure included domains medaigenesis[.]cc, novacrypt[.]net, and zzztd[.]com all hosted on 8.221.100[.]222, with related artifacts like Novacrypt.mobileconfig and Android APKs linking to C2 domains such as anedhaude[.]xyz. #medaigenesis[.]cc #novacrypt[.]net
Keypoints
- Multiple scam websites (medaigenesis[.]cc, novacrypt[.]net, zzztd[.]com) were hosted on the same IP 8.221.100[.]222, indicating a single coordinated infrastructure.
- medaigenesis[.]cc posed as “MedAI Genesis” and used a fake Trust Wallet Connect popup (styling from extension ID egjidjbpglichdcondbcbdnbeeppgdph) to trick users into approving transactions that drain wallets.
- novacrypt[.]net served a malicious iOS configuration profile (Novacrypt.mobileconfig) that installs a WebClip to h5.novacryptmax[.]com, effectively creating a fake app icon that opens a phishing login page.
- zzztd[.]com presented as a trading platform but included obfuscated JavaScript (app.46e5246269e54881.js) that referenced a suspicious domain anedhaude[.]xyz and shared infrastructure with an Android Trojan (ioeai.apk).
- The campaign used social engineering (AI, healthcare, trading lures), copied UI assets (Trust Wallet CSS/fonts), and free certificates/registrations (e.g., Let’s Encrypt, Gname registrar) to appear legitimate.
- Passive DNS shows activity from April–August 2025; novacrypt[.]net’s A record stopped resolving on Sept 25, suggesting infrastructure changes or takedown.
- At least eight related domains/subdomains and artifacts (mobileconfig, APK, JS hashes) provide actionable IOCs for detection and blocking.
MITRE Techniques
- [T1588] Obtain Capabilities – Actors registered multiple domains and used a shared hosting IP (8.221.100[.]222) to deploy phishing sites and deliver malicious artifacts (“…all these seemingly disparate scams were hosted on a single IP address: 8.221.100[.]222”).
- [T1222] Phishing – Webclip and fake app installation via iOS configuration profile to capture credentials (“…the user installs the profile on their iPhone… a new “Novacrypt” icon now appears on the home screen… it quietly opens Safari to h5.novacryptmax[.]com/#/pages/auth/sign-in”).
- [T1606] Data from Local System – Web-based wallet connect prompts and malicious JavaScript request signing/approvals to obtain permissions and siphon funds (“…clicking “Connect” does not trigger a secure wallet handshake… the site can hide code that makes your wallet approve a dangerous transaction”).
- [T1204] User Execution – Social engineering and UI mimicry (copied Trust Wallet CSS/fonts) to trick users into approving transactions or installing profiles (“…the CSS from Trust Wallet’s Chrome extension… is a key mechanism to provide styling and fonts… mimics the look of the genuine extension UI”).
- [T1566] Phishing via Web Services – Phishing pages and fake trading apps hosted on attacker-controlled domains used to harvest credentials (“…h5.novacryptmax[.]com/#/pages/auth/sign-in – The crux of the scam: this is the URL that the WebClip opens… a phishing webpage”).
- [T1203] Exploitation for Client Execution – Malicious JavaScript and links to an Android APK that may deliver malware to users (“…zzztd[.]com shares infrastructure or code with known malware… anedhaude[.]xyz… ioeai.apk”).
- [T1583] Acquire Infrastructure – Use of Cloudflare, free certificates, and registrar accounts (Gname) to host and obscure scam domains (“…registered through the same registrar (Gname.com Pte. Ltd.)… hosted behind Cloudflare… signature references “Let’s Encrypt””).
Indicators of Compromise
- [IP Address] hosting server – 8.221.100[.]222 (hosted multiple scam domains: medaigenesis[.]cc, novacrypt[.]net, zzztd[.]com)
- [Domain] wallet-drainer / scam landing pages – medaigenesis[.]cc, novacrypt[.]net
- [Domain] phishing WebClip target / fake app pages – h5.novacryptmax[.]com, novacryptmax[.]com
- [Domain] fake trading platform / malicious JS – zzztd[.]com, web.zzztd[.]com
- [File / Profile] iOS configuration profile (WebClip installer) – x417004-WebClip240618-205808-qf0.mobileconfig (served from novacrypt[.]net)
- [File Hash] JavaScript file hash – 430a73bc2a01dd1c5c84c5cc8bf0c65b (SHA-256) for app.46e5246269e54881.js
- [File Hash] Android APK hash – 884cc0b03fbb7f8282916433987ccd8573460d8c2daa (SHA-256) for ioeai.apk
- [Domain] suspicious C2 / related infrastructure – anedhaude[.]xyz (contacted by web script and Android Trojan)
- [Chrome Extension ID] extension used to mimic UI – egjidjbpglichdcondbcbdnbeeppgdph (Trust Wallet-style extension referenced on phishing pages)
Read more: https://dti.domaintools.com/inside-a-crypto-scam-nexus/