# PhishDestroy domain threat record: blockwavewallets.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/blockwavewallets.com/
Machine-readable companion: https://phishdestroy.io/domain/blockwavewallets.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-29 04:32:54 UTC
- Last availability or vendor check: 2026-10-22 10:26:46 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.81.35
- Registrar in stored WHOIS data: Megazone Corp., dba HOSTING.KR
- Registrar country in stored WHOIS data: KR
- Last stored HTTP status: 200
- Registration date (registry RDAP, blockwavewallets.com): 2026-09-10 08:12:03 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb6f-1c12-71ef-946f-6b3f6965dd42/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/blockwavewallets.com
- Certificate Transparency search: https://crt.sh/?q=%25.blockwavewallets.com
- Web Archive lookup: https://web.archive.org/web/*/https://blockwavewallets.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
blockwavewallets.com poses as the sign-in page of a crypto wallet service called Block Wave. Its page title, "Block wave - 로그인", uses the Korean word for "login", which points to Korean-speaking wallet users as the intended audience. PhishDestroy first flagged the domain on 2026-09-29. As of 2026-10-19 the site was still online and serving its phishing content.

How the scam works
This is a lookalike login screen. The domain combines the brand name with the generic word "wallets" to look like an official address. Anyone who signs in hands their username, password and any one-time codes to the operators. Wallet impersonation pages often go further and ask for a recovery phrase or private key to "restore" or "verify" access. With a recovery phrase, an attacker can rebuild the wallet on their own device and empty it, and blockchain transfers cannot be reversed.

Evidence
On 2026-10-07, 18 of 92 VirusTotal engines flagged the domain. They included BitDefender, ESET, Fortinet, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF and Criminal IP. Spamhaus lists the domain in its DBL under the phishing category, so many mail filters will block messages that link to it. The domain also appears in five AlienVault OTX threat pulses. PhishDestroy carries it on its own blocklist.

Infrastructure
The domain was registered on 2026-09-10 through Megazone Corp. (HOSTING.KR), a Korean registrar, which matches the Korean-language login page. PhishDestroy detected it 19 days after registration, a typical gap for a phishing domain set up shortly before a campaign. The site sits behind Cloudflare, with the edge address geolocated to Canada, so its real origin server is hidden. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the site is legitimate.

What to do
If you entered a password on this page, change it right away on the genuine Block Wave service and anywhere else you reused it. Then reset two-factor authentication and review recent logins. If you typed a recovery phrase or private key, treat the wallet as compromised and move any remaining funds to a newly created wallet immediately. If you connected a wallet and signed anything, revoke token approvals with a reputable approval checker. Defenders should block the domain at DNS, proxy and mail gateways and search their logs for earlier visits. Abuse reports to Cloudflare and the registrar can help get the site taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb6f-1c12-71ef-946f-6b3f6965dd42/
VirusTotal report: https://www.virustotal.com/gui/domain/blockwavewallets.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blockwavewallets.com
Archived copy: https://web.archive.org/web/20260929043253/https://blockwavewallets.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:33:04 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/60TQfXPt/37426ec76572.png
  Captured: 2026-09-29 04:32:54 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb6f-1c12-71ef-946f-6b3f6965dd42.png
  Captured: 2026-09-29 04:32:54 UTC
  Source report: https://urlscan.io/result/01a0eb6f-1c12-71ef-946f-6b3f6965dd42/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e8e9-88b4-7780-b65d-5ab136dabdd9.png
  Captured: 2026-09-29 04:31:46 UTC
  Source report: https://urlscan.io/result/01a0eb6f-1c12-71ef-946f-6b3f6965dd42/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/67a31288-6d25-4492-9820-7ecf0f9fe37d.png
  Captured: 2026-09-29 05:03:50 UTC
  Source report: https://radar.cloudflare.com/scan/67a31288-6d25-4492-9820-7ecf0f9fe37d
  SHA-256: ad141e4e9ad4921cb81618b293c8cf1d2712fc023fe56ee547e71a7b7d665df4
- URLQuery: https://screenshots.phishdestroy.io/uq/96311f15-199d-4f74-a72f-dff4dc361cb9.png
  Source report: https://urlquery.net/report/96311f15-199d-4f74-a72f-dff4dc361cb9
  SHA-256: a428c7e70e854f233719a2be6e0e095f590f5c441828f02ce60faedbdb48b64f
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d9c9-60f6-7718-975a-01835c7fce14.png
  Captured: 2026-09-25 18:17:37 UTC
  Source report: https://urlscan.io/result/01a0d9c9-60f6-7718-975a-01835c7fce14/
  SHA-256: 4d7b231bd10a2a2863ef4c91472ddc028ff6451933999ddb6f39fa6d6f84cb86
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ed40-65ae-71b4-a90d-a386c1e05eb9.png
  Captured: 2026-09-29 13:00:42 UTC
  Source report: https://urlscan.io/result/01a0ed40-65ae-71b4-a90d-a386c1e05eb9/
  SHA-256: a89913b98e74f90be1ccd15673d2fb83066f23134b84c7ba0a77cd7c23429b12
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ee12-34db-75cf-8461-28795f34df62.png
  Captured: 2026-09-29 16:49:35 UTC
  Source report: https://urlscan.io/result/01a0ee12-34db-75cf-8461-28795f34df62/
  SHA-256: 8df842fb72864b9824de308b1b99936504de6121f6fe8a759fe395350af3801c
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ee1f-3518-70f2-af76-817c0c23d5b3.png
  Captured: 2026-09-29 17:03:56 UTC
  Source report: https://urlscan.io/result/01a0ee1f-3518-70f2-af76-817c0c23d5b3/
  SHA-256: 8df842fb72864b9824de308b1b99936504de6121f6fe8a759fe395350af3801c
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14c8a-8148-7691-b66c-8c675085a9b4.png
  Captured: 2026-10-18 01:05:33 UTC
  Source report: https://urlscan.io/result/01a14c8a-8148-7691-b66c-8c675085a9b4/
  SHA-256: 65d7dffe3f353480da136f183e3dc9354acae360dc649fbc38fad8dbcce234c2
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a157e9-c951-709c-8d22-cae7f8d81739.png
  Captured: 2026-10-20 06:05:11 UTC
  Source report: https://urlscan.io/result/01a157e9-c951-709c-8d22-cae7f8d81739/
  SHA-256: 8df842fb72864b9824de308b1b99936504de6121f6fe8a759fe395350af3801c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:01Z",
        "uuid": "01a0eb6f-1c12-71ef-946f-6b3f6965dd42",
        "scanned_at": "2026-09-29T04:32:09Z",
        "final_url": "https://blockwavewallets.com/admin/login",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://blockwavewallets.com/admin/login",
                "from": "http://blockwavewallets.com/admin/login",
                "status": 307
            }
        ],
        "ip": "104.21.81.35",
        "ips": [
            "104.21.81.35"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "e1cf6d9f8aef0a7e9219e155e76a938adc28d16af997fc919b757905f915d23d",
        "globals": [
            "requestResize"
        ],
        "tls": {
            "san": [
                "*.blockwavewallets.com",
                "blockwavewallets.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "blockwavewallets.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-09T07:27:20Z",
            "valid_from": "2026-09-10T07:27:21Z"
        },
        "domain_age_days": 18,
        "apex_age_days": 18,
        "tls_age_days": 18,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 90,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:43Z",
        "uuid": "67a31288-6d25-4492-9820-7ecf0f9fe37d",
        "scanned_at": "2026-09-29T05:03:50Z",
        "final_url": "https://blockwavewallets.com/",
        "status": 200,
        "history": [
            {
                "url": "https://blockwavewallets.com/",
                "status": 200
            }
        ],
        "dom_hash": "c7308ae3da4d903dd3087945284e6275d14897bab9488d0a60ed7e9798e8024e",
        "doc_hash": "912dd241f38c8e0b6dc8a9735f9d17731c8cbe13ea2313661e42a5238f46e71f",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "blockwavewallets.com",
                "type": "A",
                "value": "104.21.81.35"
            },
            {
                "name": "blockwavewallets.com",
                "type": "A",
                "value": "172.67.137.211"
            },
            {
                "name": "blockwavewallets.com",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:89d3"
            },
            {
                "name": "blockwavewallets.com",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5123"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.81.35",
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "created": "2026-09-10T08:12:03Z",
            "updated": "2026-09-10T08:17:59Z",
            "expires": "2027-09-10T08:12:03Z",
            "nameservers": [
                "kareem.ns.cloudflare.com",
                "wanda.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:54Z",
        "analysis_at": "2026-10-18T16:33:38Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 17,
            "suspicious": 2,
            "undetected": 29
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Criminal IP": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-09-10T00:00:00Z",
        "first_seen": "2026-09-10T08:29:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:5123"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.81.35"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "kareem.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:89d3"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "wanda.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "kareem.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.137.211"
            }
        ],
        "dns_at": "2026-10-18T16:34:25Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.blockwavewallets.com",
                "blockwavewallets.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5f1bb61e4a6f36643aa514812fbea8b8f5d",
            "sha256": "37b25b27cff5dae788563b5ba5d71bae146574c6090f32a699b5dce3c66c35bc",
            "subject": "blockwavewallets.com",
            "valid_to": "2026-12-09T07:27:20Z",
            "valid_from": "2026-09-10T07:27:21Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-10T08:12:03Z",
                "last changed": "2026-09-10T08:17:59Z",
                "registration": "2026-09-10T08:12:03Z",
                "last update of RDAP database": "2026-10-17T07:40:56Z"
            },
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "registrar_iana_id": "1489"
        }
    }
}
```