wallet[.]launchlayer[.]xyz

wallet.launchlayer.xyz is a subdomain of launchlayer.xyz. PhishDestroy first observed the hostname on Mar 30, 2026. The hostname uses “wallet,” a pattern consistent with a wallet lure; no target brand is confirmed from stored content. The captured page title is “LayerWallet”. Stored page analysis classifies the content as wallet/seed phishing. Campaign clustering links the hostname to the Airdrop Scam kit. Current evidence score: 78/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 8 detections among 94 engines on May 15, 2026 at 03:12 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection on Mar 30, 2026 at 16:57 UTC. On Mar 30, 2026 at 17:56 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:10 UTC.

Cloaking was recorded with HTTP 502 on Aug 7, 2026 at 01:28 UTC. The cloaking probe recorded content split conditional delivery at 1/100 on Aug 7, 2026 at 01:28 UTC: dead_http: raw=http_502; http=502; via=http_proxy. Registration records for the registrable domain launchlayer.xyz list Namecheap as the registrar and Mar 30, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 64.29.17.1 on AS16509 (Amazon.com, Inc.). The IP and ASN identify shared Vercel edge infrastructure; the origin server is not established by this address. The stored server header is openresty. DOM analysis on Jul 29, 2026 at 04:02 UTC returned 78/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jun 28, 2026; checked Mar 31, 2026 at 06:13 UTC.

Stored content provides classification context, but only one source contains a positive finding.