walletcheckeraml[.]xyz

PhishDestroy identifies walletcheckeraml.xyz as an active crypto drainer phishing domain designed to trick cryptocurrency users into connecting their digital wallets and stealing funds. The site mimics legitimate wallet-checking services but instead deploys malicious smart contracts that drain tokens and NFTs upon wallet connection. Once connected, users often see rapid unauthorized transfers out of their wallets as the drainer executes token approvals and transfers in the background.

This domain was flagged by PhishDestroy with a unique seed identifier bca185. VirusTotal analysis shows it is currently detected by only 1 out of 95 participating security vendors, indicating low early-stage detection despite clear malicious intent. The domain was registered on April 18, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and resolves to IP address 172.67.158.30. The site also holds a valid Let’s Encrypt SSL certificate, which is often used by threat actors to appear legitimate and bypass browser warnings.

If you visited walletcheckeraml.xyz, disconnect your wallet immediately from the site via your wallet interface and revoke any token approvals that may have been granted. Use tools such as Etherscan’s Token Approval Checker or Revoke.cash to inspect and revoke suspicious approvals. Monitor your wallet for unauthorized transactions and consider transferring remaining assets to a newly generated wallet address. Report the domain to your antivirus provider and avoid similar wallet-checking services unless you are certain of their legitimacy. Always verify URLs, check for HTTPS, and use hardware wallets for added security when managing crypto assets.