wallet-sun[.]org

wallet-sun.org was registered on July 22, 2026 through Fewmoretaps OU d/b/a Trustname.com and is currently hosted on Cloudflare infrastructure, as indicated by the authoritative nameservers maciej.ns.cloudflare.com and sarah.ns.cloudflare.com. DNS resolution points to the address 104.21.42.40, a Cloudflare‑owned IP range commonly used by a variety of legitimate and malicious actors. The domain appears on a single security blocklist and has been flagged by the PhishDestroy feed as a crypto‑drainer, suggesting that it is intended to lure cryptocurrency users into disclosing private keys or sending funds to an attacker‑controlled wallet.

No public scanning results are available from VirusTotal, and the domain has not been reported by other major aggregators, leaving the detection surface limited to the PhishDestroy indicator. The short lifespan—only two days between creation and the current report date—combined with the rapid appearance on a blocklist is consistent with a fast‑flux or throwaway campaign often employed for crypto‑drainer operations. Because the underlying web content has not been crawled, the specific page title, SSL certificate details, HTTP response codes, or any embedded malicious payloads remain unknown.

Consequently, defenders cannot rely on signature‑based detection alone and should incorporate network‑level controls. Recommended mitigation steps include blocking outbound connections to 104.21.42.40 at the firewall, adding wallet‑sun.org to DNS deny‑list policies, and monitoring for anomalous cryptocurrency transaction patterns that reference this domain or its associated IP. Continuous re‑evaluation is advised, as the threat actor may shift hosting or register additional domains to evade takedown efforts.