Cryptocurrency Drain Conspiracy: Single Alibaba Server Hosts Multi-Vector Scams, Hijacking Wallets via Fake Trust Wallet and MobileConfig

DomainTools Threat Intelligence has exposed a sprawling cybercrime operation that uses a single infrastructure to power multiple cryptocurrency theft schemes, hosted on an Alibaba Cloud server in Asia. The investigation ties websites medaigenesis[.]cc, novacrypt[.]net, and zzztd[.]com to the same IP address, 8.221.100[.]222, described as a “one-stop hosting hub” for cryptocurrency scams.

According to DomainTools, all three scam domains share infrastructure, registrar, and design patterns, and have been active since at least April 2025, continuing into August 2025. The campaigns impersonate legitimate tech startups or trading platforms and push users to connect wallets, install malicious profiles, or submit exchange credentials, enabling instant asset theft.

One front, MedAI Genesis, masquerades as a Trust Wallet-like extension and uses a malicious JavaScript to drain tokens once a user clicks Connect or approves a transaction. The operation also distributes a malicious Apple configuration profile (.mobileconfig) from novacrypt[.]net to iPhone users, and a web-based trading site, zzztd[.]com, that loads suspicious scripts linked to an Android Trojan.