# PhishDestroy domain threat record: hivewallet.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hivewallet.net/
Machine-readable companion: https://phishdestroy.io/domain/hivewallet.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 16:39:56 UTC
- Last availability or vendor check: 2026-10-28 00:30:50 UTC
- Stored record updated: 2026-10-28 00:30:50 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 46.21.153.133
- Registrar in stored WHOIS data: NameSilo, LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-08 16:58:57 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17e47-670c-73fc-89f7-1f207833de43/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hivewallet.net
- Certificate Transparency search: https://crt.sh/?q=%25.hivewallet.net
- Web Archive lookup: https://web.archive.org/web/*/https://hivewallet.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated intake on 2026-10-27 classified hivewallet.net as malicious because VirusTotal reported one malicious detection. The recorded page title advertises “HIVE Wallet — Self‑Custody Wallet for HIVE and HBD” and claims to provide a downloadable desktop wallet, which the prior assessment identified as a typical impersonation of the Hive blockchain wallet service. An HTTP 200 response was observed on the same date.

How the scam works
Impostor sites that mimic legitimate cryptocurrency wallets often distribute malicious desktop applications or harvest seed phrases and private keys. By presenting a convincing brand name and offering a download, they aim to trick users into installing software that can steal funds or credentials.

Evidence
VirusTotal scanned the domain on 2026-10-27 and marked it malicious in 1 of 92 engines, with Forcepoint ThreatSeeker labeling it as phishing. Google Safe Browsing checked the same day and did not flag the URL. urlscan captured the site on 2026-09-10 and returned a clean verdict, while a later scan on 2026-10-27 assigned a machine‑learning score of 48 and a malicious tag. OTX listed four pulses referencing the domain as of 2026-10-27. PhishDestroy’s internal blocklist contains the domain, whereas external blocklists showed no entries at the time of checking.

Infrastructure
The domain was registered on 2026-09-08 through NameSilo, LLC, giving it a 49‑day age at first sighting. Records show it resolved to IP 46.21.153.133, which belongs to ASN 29802 identified as HIVELOCITY, Inc. in the United States. The site presented an Apache server header and a Let’s Encrypt TLS certificate issued on 2026-09-08 with validity through 2026-12-07.

What to do
Do not download or install any software from hivewallet.net and avoid entering Hive seed phrases or private keys on the site. Users who may have submitted credentials should rotate any associated passwords and monitor their Hive accounts for unauthorized activity. Network defenders should block the domain and review logs for any connections to the recorded host.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17e47-670c-73fc-89f7-1f207833de43/
Cloudflare Radar report: https://radar.cloudflare.com/scan/37c862dc-2b8b-4dab-97e2-9ecee1258a27
URLQuery report: https://urlquery.net/report/5f83b871-178f-4be4-84eb-d90dadac00cf
Stored capture screenshot: https://i.ibb.co/DPDGJphV/4c013cb6aeef.png
Cloudflare Radar screenshot (2026-10-27T16:42:15Z): https://screenshots.phishdestroy.io/cf/37c862dc-2b8b-4dab-97e2-9ecee1258a27.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/5f83b871-178f-4be4-84eb-d90dadac00cf.png
URLScan screenshot (2026-09-08T20:11:25Z): https://screenshots.phishdestroy.io/us/01a082a5-79ae-761e-bf2c-45b706c0d20a.png
URLScan capture report: https://urlscan.io/result/01a082a5-79ae-761e-bf2c-45b706c0d20a/
VirusTotal report: https://www.virustotal.com/gui/domain/hivewallet.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hivewallet.net
Archived copy: https://web.archive.org/web/20261027164315/https://hivewallet.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 17:44:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/DPDGJphV/4c013cb6aeef.png
  Captured: 2026-10-27 16:54:21 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17e47-670c-73fc-89f7-1f207833de43.png
  Captured: 2026-10-27 16:54:21 UTC
  Source report: https://urlscan.io/result/01a17e47-670c-73fc-89f7-1f207833de43/
- URLScan capture 2: https://urlscan.io/screenshots/01a0897b-cedb-72e1-9558-9add09ddf782.png
  Captured: 2026-10-27 16:39:56 UTC
  Source report: https://urlscan.io/result/01a17e47-670c-73fc-89f7-1f207833de43/
- URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a082a5-79ae-761e-bf2c-45b706c0d20a.png
  Captured: 2026-09-08 20:11:25 UTC
  Source report: https://urlscan.io/result/01a082a5-79ae-761e-bf2c-45b706c0d20a/
  SHA-256: dc5313c3863f43d68675b0bb9e333e345aef3d77343ad2dc21af361e090cebfe
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/37c862dc-2b8b-4dab-97e2-9ecee1258a27.png
  Captured: 2026-10-27 16:42:15 UTC
  Source report: https://radar.cloudflare.com/scan/37c862dc-2b8b-4dab-97e2-9ecee1258a27
  SHA-256: f99cece05789471ec20b22f6596b831b4a312826e6602236a6e8de284c661491
- URLQuery: https://screenshots.phishdestroy.io/uq/5f83b871-178f-4be4-84eb-d90dadac00cf.png
  Source report: https://urlquery.net/report/5f83b871-178f-4be4-84eb-d90dadac00cf
  SHA-256: af6f8a30480818e421e1921d54c06907b162415abbf8b4458fa93771f1037b27

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T17:12:16Z",
        "uuid": "01a17e47-670c-73fc-89f7-1f207833de43",
        "scanned_at": "2026-10-27T16:53:14Z",
        "final_url": "https://hivewallet.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hivewallet.net/",
                "from": "http://hivewallet.net/",
                "status": 307
            }
        ],
        "ip": "46.21.153.133",
        "ptr": "133.153.21.46.static.swiftway.net",
        "ips": [
            "46.21.153.133"
        ],
        "asns": [
            "29802"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "e23f4542fb9962bf6c9ab118251db1a81a219a9f50b963cd4819a2bb7582f921",
        "script_hashes": [
            "1d36f2e3f57740f75eb021aaec1208d7e938130e36c106a9f28678e4a98559b0",
            "6f7927041946fafd1fabaaa08dc3bc1deab43dbcadc09584ba7f578ca097e745",
            "a342dc1f42035a70a721f3081250a6645fab047c2e268f1453686349a6f16548",
            "b0c9536f0624009caab21f56a76579a4ab3603ab203e1857c1fa26f54fe884a1",
            "8954716437b35e20f4b26080e8cc50dc378dbfafb1fb02fb6fd8a724ed737df2",
            "6c4d5fc08081a26e6ab2a002fd2af25b0669ca328505160a5a69a832f7068fff",
            "76c1666270bf17b017f06fa91c1c876a33a584fd508d99470a83d7a831404684",
            "6a67089fb364df84f4c2200882472604b6098b56e3d2ddaae03fe6f2e982f355",
            "49d4f29ddbc9bbeb52f5d4e9d6001791046dbf3343402ddd13e8f5af7449cb32",
            "34ed6abf4c6d0d1bb3dc56d3f133d2a5dbc3a3c89c791deab314e27143ac14ce"
        ],
        "globals": [
            "TURBOPACK",
            "__next_f",
            "next",
            "__webpack_hash__"
        ],
        "tls": {
            "san": [
                "hivewallet.net",
                "www.hivewallet.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "www.hivewallet.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-07T18:32:00Z",
            "valid_from": "2026-09-08T18:32:01Z"
        },
        "domain_age_days": 1351,
        "apex_age_days": 1351,
        "tls_age_days": 48,
        "tls_valid_days": 89,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 48,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-src 'self'; object-src 'none'; bas",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin-allow-popups"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T16:44:36Z",
        "uuid": "37c862dc-2b8b-4dab-97e2-9ecee1258a27",
        "scanned_at": "2026-10-27T16:42:15Z",
        "final_url": "https://hivewallet.net/",
        "status": 200,
        "history": [
            {
                "url": "https://hivewallet.net/",
                "status": 200
            }
        ],
        "dom_hash": "7bb340f395411f6cd142ff70023f0fe124aa1f9a3f8799f43cf3a37ba0cbc191",
        "doc_hash": "e23f4542fb9962bf6c9ab118251db1a81a219a9f50b963cd4819a2bb7582f921",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "hivewallet.net",
                "type": "A",
                "value": "46.21.153.133"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.13",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-09-08T18:58:57Z",
            "updated": "2026-09-08T18:58:58Z",
            "expires": "2027-09-08T18:58:57Z",
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T17:43:23Z",
        "analysis_at": "2026-10-27T11:40:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "NameSilo, LLC",
        "created": "2026-09-08T18:58:57Z",
        "expires": "2027-09-08T18:58:57Z",
        "updated": "2026-09-08T18:58:58Z",
        "first_seen": "2026-09-08T20:37:48Z",
        "dns": [
            {
                "ttl": 3603,
                "type": "A",
                "value": "46.21.153.133"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "hostmaster.dnsowl.com",
                "value": "ns1.dnsowl.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.dnsowl.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.dnsowl.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.dnsowl.com"
            }
        ],
        "dns_at": "2026-10-27T11:40:39Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "hivewallet.net",
                "www.hivewallet.net"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5d394bdb5ecc2871f72b0711720d887b31c",
            "sha256": "4afdc0a072e519553016a28adc57982dfa804609ee073c5c36edd92814146e07",
            "subject": "www.hivewallet.net",
            "valid_to": "2026-12-07T18:32:00Z",
            "valid_from": "2026-09-08T18:32:01Z"
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "http://www.namesilo.com",
            "created": "2026-09-08T18:58:57Z",
            "updated": "2026-09-08T18:58:58Z",
            "expires": "2027-09-08T18:58:57Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-10-23T01:42:54Z",
                "registration": "2026-09-08T00:00:00Z",
                "registrar expiration": "2027-09-08T00:00:00Z",
                "last update of RDAP database": "2026-10-27T07:05:55Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T16:44:58Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "hivewallet.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T16:43:15Z",
            "first": "2026-10-27T16:43:15Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 18193
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://hivewallet.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "ogUrl": "https://hivewallet.net/",
            "title": "HIVE Wallet — Self-Custody Wallet for HIVE and HBD",
            "author": "HIVE Wallet",
            "ogType": "website",
            "robots": "index, follow",
            "ogImage": "https://hivewallet.net/opengraph-image",
            "ogTitle": "HIVE Wallet — Self-Custody Wallet for HIVE and HBD",
            "keywords": "HIVE wallet,Hive blockchain wallet,HIVE and HBD wallet,self-custody wallet,desktop crypto wallet,local transaction signing,Hive account,Windows wallet,macOS wallet,Linux wallet",
            "ogSiteName": "HIVE Wallet",
            "themeColor": "#ffffff",
            "description": "Manage Hive accounts, HIVE and HBD transfers, role-based keys, QR workflows and locally signed operations with a focused desktop wallet for Windows, macOS and Linux.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://hivewallet.net/",
            "ogDescription": "Manage Hive accounts, HIVE and HBD transfers, role-based keys, QR workflows and locally signed operations with a focused desktop wallet for Windows, macOS and Linux."
        },
        "trackers": {
            "requests": 17
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 263,
                "tls": 166,
                "wait": 208,
                "connect": 158,
                "download": 287
            },
            "response_ms": 1082
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                3306
            ]
        },
        "carbon": {
            "bytes": 89274,
            "co2_grams": 0.0033,
            "cleaner_than": 24
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.173",
                    "host": "ns1.dnsowl.com"
                },
                {
                    "ip": "162.159.26.49",
                    "host": "ns2.dnsowl.com"
                },
                {
                    "ip": "162.159.26.234",
                    "host": "ns3.dnsowl.com"
                }
            ],
            "zone": "hivewallet.net"
        },
        "location": {
            "ip": "46.21.153.133",
            "asn": "29802",
            "org": "HIVELOCITY, Inc.",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "www.hivewallet.net"
        },
        "dns": {
            "A": [
                "46.21.153.133"
            ],
            "NS": [
                "ns3.dnsowl.com",
                "ns1.dnsowl.com",
                "ns2.dnsowl.com"
            ],
            "SOA": "{\"nsname\": \"ns1.dnsowl.com\", \"hostmaster\": \"hostmaster.dnsowl.com\", \"serial\": 1788895099, \"refresh\": 7200, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 600}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; fon",
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": "same-origin-allow-popups",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "46.21.153.133",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://hivewallet.net"
            ]
        },
        "linked_pages": {
            "internal_count": 18
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-09-08T18:58:57Z",
            "updated": "2026-09-08T18:58:58Z",
            "expires": "2027-09-08T18:58:57Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dnsowl.com",
                "ns2.dnsowl.com",
                "ns3.dnsowl.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "Apache",
                "content-type": "text/html; charset=UTF-8",
                "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin-allow-popups"
            }
        }
    }
}
```