carbonwallet[.]ru

The domain carbonwallet.ru was registered on 26 March 2026 through REGRU-RU and resolves to the Cloudflare IP address 188.114.96.3, located in Canada. Its authoritative nameservers are listed as kanye.ns.cloudflare.com and olga.ns.cloudflare.com. The site serves content over HTTPS using a certificate issued by Google Trust Services (WE1) and returns HTTP status 200. Automated analysis identifies a WordPress stack backed by MySQL and PHP, with client‑side libraries including jQuery, jQuery Migrate, and Yandex.Metrika, and it enables HSTS and Cloudflare Browser Insights. The page title "Bitcoin и криптокошелек Carbon Wallet" indicates a brand‑impersonation attempt targeting Bitcoin users. The domain appears on one public security blocklist and has a Gridinsoft trust score of 0/100. VirusTotal records show that 1 of 94 scanned security vendors flagged the domain, and it is currently blocked by PhishDestroy. The threat is classified as brand impersonation and is marked as active with a high risk rating. While the exact page content beyond the title has not been inspected, the technical footprint and detection history suggest a malicious intent to deceive Bitcoin‑related traffic. Defenders should add carbonwallet.ru to URL filtering rules, monitor DNS queries for the associated IP, and consider sinkholing or takedown actions. Continuous observation is advised to detect any changes in hosting, content, or detection scores.