grapewallet[.]org

This domain, grapewallet.org, is currently classified as a high‑risk crypto drainer and remains active despite being listed on the PhishDestroy blocklist. The domain was registered on 11 Nov 2025 through GoDaddy.com, LLC and is hosted on an Amazon.com, Inc. infrastructure (ASN 16509) located in the United States, resolving to IP 3.12.120.221. TLS is provided by Let’s Encrypt (certificate identifier E7) and the site returns HTTP 200. DNS resolution uses GoDaddy’s default nameservers pdns03.domaincontrol.com and pdns04.domaincontrol.com. Independent scanning on VirusTotal shows that two of ninety‑five security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, indicating a strong likelihood of malicious activity. The page title reported is “Grape Wallet – Web3 Platform,” suggesting a focus on cryptocurrency services, but no further content analysis is available. At this time the observable infrastructure confirms the presence of a malicious crypto‑draining operation, while the exact payload or victim interaction details remain unknown. Defenders should block the domain at network perimeters, monitor DNS queries for the associated IP and nameservers, and add the domain to endpoint and email filtering rules. Ongoing surveillance is recommended to detect any changes in hosting or certificate status.