walletscope[.]icu

This domain, walletscope.icu, is identified as a crypto drainer infrastructure designed to illicitly siphon cryptocurrency from connected digital wallets. Analysis indicates the site masquerades as a blockchain explorer under the title 'WalletScope - Blockchain Explorer,' a tactic commonly employed to deceive users into authorizing malicious transactions. No legitimate brand association is confirmed, though the naming convention suggests an attempt to mimic established blockchain services. The domain does not appear to use a publicly documented drainer kit, but its behavior aligns with known crypto-draining campaigns targeting unsuspecting users through social engineering and fake approval prompts. Technical indicators reveal multiple high-risk attributes. The domain was registered on February 01, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 188.114.97.3, which has been flagged in prior threat intelligence reports. VirusTotal detection shows 10 out of 95 security vendors marking the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. Detected technologies include Google Cloud, Cloudflare, and HSTS, suggesting the use of bulletproof hosting and content delivery networks to evade takedowns. No Google Safe Browsing (GSB) listing is currently recorded, though this may reflect a lag in propagation rather than a clean status. As of the latest assessment, walletscope.icu has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, the residual risk remains elevated. Threat actors may re-deploy the infrastructure under a new domain or IP address, leveraging the same social engineering tactics. Users are advised to revoke any wallet approvals associated with this domain and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include the domain and IP address, while individuals should exercise caution when interacting with unsolicited blockchain-related services. The use of hardware wallets and multi-signature approvals can mitigate exposure to similar threats.