# PhishDestroy domain threat record: cryptowalletelectrum.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cryptowalletelectrum.com/
Machine-readable companion: https://phishdestroy.io/domain/cryptowalletelectrum.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:34:49 UTC
- Last availability or vendor check: 2026-10-24 22:52:16 UTC
- Stored record updated: 2026-10-24 22:52:16 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Electrum

## Stored infrastructure

- Observed IP address: 164.92.92.171
- Registrar in stored WHOIS data: INWX GmbH
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, cryptowalletelectrum.com): 2026-08-13 19:02:30 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a166c1-d7af-733d-8b44-5e8069df72af/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cryptowalletelectrum.com
- Certificate Transparency search: https://crt.sh/?q=%25.cryptowalletelectrum.com
- Web Archive lookup: https://web.archive.org/web/*/https://cryptowalletelectrum.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI flagged cryptowalletelectrum.com as malicious because the page imitates the official Electrum Bitcoin wallet, using the brand name and a generic feature description on a domain that does not belong to electrum.org. The page title reads “Crypto Wallet Electrum | Secure Bitcoin Wallet …” and the recorded excerpt lists typical Electrum features, which matches the impersonation pattern. PhishDestroy first saw the domain on 2026-10-23, 71 days after its registration on 2026-08-13, and an HTTP 200 response was recorded on that date.

How the scam works
In brand‑impersonation phishing, attackers host a look‑alike site that claims to offer the legitimate software, prompting visitors to download a malicious installer or enter wallet credentials. Victims who install the counterfeit client may expose private keys or be directed to disclose seed phrases, enabling theft of their funds.

Evidence
VirusTotal’s scan on 2026-10-22 returned one suspicious finding from Gridinsoft among 92 engines. Google Safe Browsing checked on 2026-10-23 did not flag the domain. On 2026-10-23 the domain appeared on the external blocklists MetaMask and SEAL and is also present on PhishDestroy’s internal blocklist. urlscan’s capture on 2026-10-20 gave a clean overall verdict but its ML engine scored the URL as malicious with a 99 rating and phishing tags, and Cloudflare Radar on 2026-10-23 similarly labeled the site as phishing and malicious; OTX recorded one pulse referencing the domain on the same day.

Infrastructure
The domain was registered with INWX GmbH on 2026-08-13 and is set to expire on 2027-08-13. DNS resolved to 164.92.92.171, an address owned by DigitalOcean, LLC in the United States, and the site served a TLS 1.3 certificate issued by ZeroSSL that was valid until 2026-11-22. Nameservers ns1.dnsprotector.xyz and ns2.dnsprotector.xyz were observed for the zone.

What to do
Users should avoid downloading any software from cryptowalletelectrum.com and, if credentials or seed phrases were entered, generate a new wallet from the official electrum.org site and move funds. Enterprises should block the domain at the DNS or proxy level and monitor for connections to the recorded IP address. Security teams can add the domain to internal blocklists and review logs for any access attempts on the dates indicated.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1583e-aec5-71d7-931e-56d5f60d772b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0b39012e-a88e-4ecb-9630-d99628e0b4a2
Stored capture screenshot: https://urlscan.io/screenshots/01a1583e-aec5-71d7-931e-56d5f60d772b.png
Cloudflare Radar screenshot (2026-10-23T02:18:12Z): https://screenshots.phishdestroy.io/cf/0b39012e-a88e-4ecb-9630-d99628e0b4a2.png
URLScan screenshot (2026-10-12T11:12:13Z): https://screenshots.phishdestroy.io/us/01a12fd0-0c1c-703a-bb9c-fe602a17ceda.png
URLScan capture report: https://urlscan.io/result/01a12fd0-0c1c-703a-bb9c-fe602a17ceda/
URLScan screenshot (2026-10-12T17:09:39Z): https://screenshots.phishdestroy.io/us/01a13117-3300-7123-ae9d-275b12532efe.png
URLScan capture report: https://urlscan.io/result/01a13117-3300-7123-ae9d-275b12532efe/
URLScan screenshot (2026-10-14T10:37:24Z): https://screenshots.phishdestroy.io/us/01a139fc-bc42-7324-80ce-139fa8b38744.png
URLScan capture report: https://urlscan.io/result/01a139fc-bc42-7324-80ce-139fa8b38744/
URLScan screenshot (2026-10-16T07:34:37Z): https://screenshots.phishdestroy.io/us/01a143a2-3668-74ea-a4ae-2b73ac5c3cff.png
URLScan capture report: https://urlscan.io/result/01a143a2-3668-74ea-a4ae-2b73ac5c3cff/
URLScan screenshot (2026-10-23T01:56:46Z): https://screenshots.phishdestroy.io/us/01a16679-6c88-70ce-a81c-839e9370c62c.png
URLScan capture report: https://urlscan.io/result/01a16679-6c88-70ce-a81c-839e9370c62c/
VirusTotal report: https://www.virustotal.com/gui/domain/cryptowalletelectrum.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cryptowalletelectrum.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 02:27:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/MDKDCYdb/2bec4f0fd361.png
  Captured: 2026-10-23 03:16:40 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a166c1-d7af-733d-8b44-5e8069df72af.png
  Captured: 2026-10-23 03:16:40 UTC
  Source report: https://urlscan.io/result/01a166c1-d7af-733d-8b44-5e8069df72af/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a1583e-aec5-71d7-931e-56d5f60d772b.png
  Captured: 2026-10-23 01:34:49 UTC
  Source report: https://urlscan.io/result/01a166c1-d7af-733d-8b44-5e8069df72af/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0b39012e-a88e-4ecb-9630-d99628e0b4a2.png
  Captured: 2026-10-23 02:18:12 UTC
  Source report: https://radar.cloudflare.com/scan/0b39012e-a88e-4ecb-9630-d99628e0b4a2
  SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66
- URLQuery: https://screenshots.phishdestroy.io/uq/0cd7c774-614c-496d-ad82-a2e6f80d0d55.png
  Source report: https://urlquery.net/report/0cd7c774-614c-496d-ad82-a2e6f80d0d55
  SHA-256: e9eec26f2d5b6358cf5f5f36a8ceced43df9c311970f1143dee034187cd6b723
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12fd0-0c1c-703a-bb9c-fe602a17ceda.png
  Captured: 2026-10-12 11:12:13 UTC
  Source report: https://urlscan.io/result/01a12fd0-0c1c-703a-bb9c-fe602a17ceda/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a13117-3300-7123-ae9d-275b12532efe.png
  Captured: 2026-10-12 17:09:39 UTC
  Source report: https://urlscan.io/result/01a13117-3300-7123-ae9d-275b12532efe/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a139fc-bc42-7324-80ce-139fa8b38744.png
  Captured: 2026-10-14 10:37:24 UTC
  Source report: https://urlscan.io/result/01a139fc-bc42-7324-80ce-139fa8b38744/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a143a2-3668-74ea-a4ae-2b73ac5c3cff.png
  Captured: 2026-10-16 07:34:37 UTC
  Source report: https://urlscan.io/result/01a143a2-3668-74ea-a4ae-2b73ac5c3cff/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a1583e-aec5-71d7-931e-56d5f60d772b.png
  Captured: 2026-10-20 07:37:53 UTC
  Source report: https://urlscan.io/result/01a1583e-aec5-71d7-931e-56d5f60d772b/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16679-6c88-70ce-a81c-839e9370c62c.png
  Captured: 2026-10-23 01:56:46 UTC
  Source report: https://urlscan.io/result/01a16679-6c88-70ce-a81c-839e9370c62c/
  SHA-256: 54731ea4894eaa37816c9e61d5ce3c0c880122d04d2f158ef0a17bd65e0fe1b8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T03:26:25Z",
        "uuid": "01a166c1-d7af-733d-8b44-5e8069df72af",
        "scanned_at": "2026-10-23T03:15:49Z",
        "final_url": "https://cryptowalletelectrum.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cryptowalletelectrum.com/",
                "from": "http://cryptowalletelectrum.com/",
                "status": 307
            }
        ],
        "ip": "164.92.92.171",
        "ptr": "edge01.dnsprotector.xyz",
        "ips": [
            "164.92.92.171"
        ],
        "asns": [
            "14061"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "github.com",
            "twitter.com"
        ],
        "social": [
            "https://github.com/spesmilo/electrum",
            "https://twitter.com/ElectrumWallet"
        ],
        "doc_hash": "3eb655e7913fae28d20134eb1586ff5b029d325411e5e36ff05f87d56f930c58",
        "script_hashes": [
            "88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd",
            "1cd02bdd539cb152085e4e1583428bcb06c8128a9ec912195f8a42ed8179804f",
            "340277869a89746ff06a46d7a773d8b87708a32da1669635ddafec18aaea1ed3",
            "2ba539e4613c4c42f91845d6a05e44f8c93ec4936711b05cffae8a4f92c8a652",
            "bb7cd75130058d4e9f6226a758f9671c9a2d4d061760a78c822b997ceeb25f35",
            "6967ea3008cb1a82beafedfd1cc2871c3cdd4c5b4de87b97c5ee6c4f8a6aa942",
            "443e5dd56c9d7e9410ad662dcefbe078bf42dcb46eada4416cb7eb05d386f5c3"
        ],
        "globals": [
            "$",
            "jQuery",
            "pp_alreadyInitialized",
            "QRCode"
        ],
        "tls": {
            "san": [
                "cryptowalletelectrum.com",
                "www.cryptowalletelectrum.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "ZeroSSL RSA DV SSL CA 2",
            "subject": "cryptowalletelectrum.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-22T23:59:59Z",
            "valid_from": "2026-08-24T00:00:00Z"
        },
        "domain_age_days": 69,
        "apex_age_days": 69,
        "tls_age_days": 60,
        "tls_valid_days": 90,
        "requests": 27,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T02:26:57Z",
        "uuid": "0b39012e-a88e-4ecb-9630-d99628e0b4a2",
        "scanned_at": "2026-10-23T02:18:12Z",
        "final_url": "https://cryptowalletelectrum.com/",
        "history": [
            {
                "url": "https://cryptowalletelectrum.com/",
                "status": 0
            }
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cryptowalletelectrum.com",
                "type": "A",
                "value": "164.92.92.171"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "INWX GmbH",
            "created": "2026-08-13T19:02:30Z",
            "updated": "2026-08-23T23:22:43Z",
            "expires": "2027-08-13T19:02:30Z",
            "nameservers": [
                "ns1.dnsprotector.xyz",
                "ns2.dnsprotector.xyz"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T02:16:48Z",
        "analysis_at": "2026-10-22T06:31:58Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 39
        },
        "detections": {
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "registrar": "INWX GmbH",
        "created": "2026-08-13T19:02:30Z",
        "expires": "2027-08-13T19:02:30Z",
        "updated": "2026-08-23T23:22:43Z",
        "first_seen": "2026-08-16T01:34:00Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.cryptowalletelectrum.com",
                "value": "a.misconfigured.dns.server.invalid"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.dnsprotector.xyz"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "164.92.92.171"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.dnsprotector.xyz"
            }
        ],
        "dns_at": "2026-10-22T06:51:42Z",
        "jarm": "3fd3fd16d3fd3fd21c42d42d000000a8d52b2e606af78e33e5cbcbcdeb78a6",
        "cert": {
            "san": [
                "cryptowalletelectrum.com",
                "www.cryptowalletelectrum.com"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2",
            "serial": "edc6ae9fb11f77f2a8e23685c65cbd31",
            "sha256": "92447a4c22a60590028ca258766bbde8a0de37879c440ab1235b8b5d465bd116",
            "subject": "cryptowalletelectrum.com",
            "valid_to": "2026-11-22T23:59:59Z",
            "valid_from": "2026-08-24T00:00:00Z"
        },
        "whois": {
            "registrar": "INWX GmbH",
            "registrar_iana_id": "1420",
            "registrar_url": "http://www.inwx.com",
            "created": "2026-08-13T19:02:30Z",
            "updated": "2026-08-23T23:22:43Z",
            "expires": "2027-08-13T19:02:30Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dnsprotector.xyz",
                "ns2.dnsprotector.xyz"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-23T23:22:43Z",
                "registration": "2026-08-13T19:02:30Z",
                "registrar expiration": "2027-08-13T19:02:30Z",
                "last update of RDAP database": "2026-10-22T06:51:42Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T02:27:09Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cryptowalletelectrum.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T01:38:33Z",
            "first": "2026-10-23T01:38:33Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4185
        },
        "trackers": {
            "requests": 26
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                53,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "164.92.92.171",
                    "host": "ns1.dnsprotector.xyz"
                },
                {
                    "ip": "164.92.92.171",
                    "host": "ns2.dnsprotector.xyz"
                }
            ],
            "zone": "cryptowalletelectrum.com"
        },
        "location": {
            "ip": "164.92.92.171",
            "asn": "14061",
            "org": "DigitalOcean, LLC",
            "city": "Santa Clara",
            "country": "US"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2",
            "subject": "cryptowalletelectrum.com"
        },
        "dns": {
            "A": [
                "164.92.92.171"
            ],
            "NS": [
                "ns2.dnsprotector.xyz",
                "ns1.dnsprotector.xyz"
            ],
            "SOA": "{\"nsname\": \"a.misconfigured.dns.server.invalid\", \"hostmaster\": \"hostmaster.cryptowalletelectrum.com\", \"serial\": 2026082304, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "164.92.92.171",
            "family": 4
        },
        "tech_stack": {
            "technologies": [
                "Apache HTTP Server",
                "prettyPhoto",
                "jQuery"
            ]
        },
        "whois": {
            "registrar": "INWX GmbH",
            "created": "2026-08-13T19:02:30Z",
            "updated": "2026-08-23T23:22:43Z",
            "expires": "2027-08-13T19:02:30Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dnsprotector.xyz",
                "ns2.dnsprotector.xyz"
            ]
        }
    }
}
```