# PhishDestroy domain threat record: wallet-defender.es Content language: English Canonical HTML report: https://phishdestroy.io/domain/wallet-defender.es/ Machine-readable companion: https://phishdestroy.io/domain/wallet-defender.es/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-02 15:27:59 UTC - Last availability or vendor check: 2026-10-22 10:00:52 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.96.1 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a0f3e8-4529-7368-9a6d-37ff33cafef4/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/wallet-defender.es - Certificate Transparency search: https://crt.sh/?q=%25.wallet-defender.es - Web Archive lookup: https://web.archive.org/web/*/https://wallet-defender.es/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview wallet-defender.es is an impersonation phishing site whose name presents it as a wallet-protection or security service. It is aimed at cryptocurrency wallet users who are worried about the safety of their funds. PhishDestroy first detected it on 2026-10-02. On 2026-10-19 the site was still online and serving live content. How the scam works Sites like this rely on a reassuring name. A victim who thinks their wallet is at risk is invited to "secure", "verify" or "scan" it, and the process ends with a request for a recovery phrase or private key, or a prompt to connect the wallet and sign a transaction. A seed phrase gives the operator full control of every account derived from it, while a malicious signature or token approval lets them move assets out of the wallet. The page title reads "Just a moment...", which is a generic browser-check screen rather than branded content, but our analysis classifies the site as impersonation phishing. Evidence On 2026-10-06, VirusTotal showed nine of 91 security engines flagging the domain. Named detections came from alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, G-Data, Gridinsoft, LevelBlue and SOCRadar. Several independent commercial and threat-intel vendors reached a malicious verdict, though most engines had not yet caught up. The domain also appears in one AlienVault OTX pulse and is listed on the PhishDestroy blocklist. Infrastructure The domain resolves to 188.114.96.1 on Cloudflare's network, with the address geolocated to Canada. That means the IP points to a shared proxy edge and does not reveal the real origin server. The HTTPS certificate is a free, automatically issued Let's Encrypt (YE2) certificate, so the padlock in the browser proves nothing about who runs the site. With content still live more than two weeks after first detection, the operation remains active. What to do If you entered a recovery phrase or private key on this site, treat that wallet as compromised. Create a new wallet on a trusted device and move any remaining funds to it immediately. If you connected a wallet or signed anything, use a token-approval checker to revoke permissions you do not recognise, and watch for unexpected outgoing transfers. No legitimate wallet or security service ever asks for your seed phrase. Defenders should block wallet-defender.es at DNS and proxy level, add it to mail and web filters, and report it to Cloudflare's abuse channel so the origin can be traced. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0f3e8-4529-7368-9a6d-37ff33cafef4/ VirusTotal report: https://www.virustotal.com/gui/domain/wallet-defender.es Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wallet-defender.es Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:32:32 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0f3e8-4529-7368-9a6d-37ff33cafef4.png Captured: 2026-10-02 15:27:59 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0f3e8-4529-7368-9a6d-37ff33cafef4.png Captured: 2026-10-03 03:30:11 UTC Source report: https://urlscan.io/result/01a0f3e8-4529-7368-9a6d-37ff33cafef4/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5418b37f-6ea0-42f2-b99f-958937ac71f8.png Captured: 2026-10-02 15:30:53 UTC Source report: https://radar.cloudflare.com/scan/5418b37f-6ea0-42f2-b99f-958937ac71f8 SHA-256: fb85df96473899abe3a1a343dfacce3421a3724557d0dd483136ee92cdb1cd24 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:35:51Z", "uuid": "01a0f3e8-4529-7368-9a6d-37ff33cafef4", "scanned_at": "2026-09-30T20:01:29Z", "final_url": "https://wallet-defender.es/ledger/", "status": 403, "redirected": "off-domain", "redirects": [ { "to": "https://ldgr-secure-link.s3-website.eu-north-1.amazonaws.com/", "from": "http://ldgr-secure-link.s3-website.eu-north-1.amazonaws.com/", "status": 307 }, { "to": "http://ldgr-secure-link.s3-website.eu-north-1.amazonaws.com/", "from": "https://ldgr-secure-link.s3-website.eu-north-1.amazonaws.com/", "status": 307 }, { "to": "https://wallet-defender.es/ledger/", "from": "http://ldgr-secure-link.s3-website.eu-north-1.amazonaws.com/" }, { "to": "https://wallet-defender.es/ledger/", "from": "https://wallet-defender.es/ledger/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "challenges.cloudflare.com", "ldgr-secure-link.s3-website.eu-north-1.amazonaws.com" ], "ips": [ "104.18.95.41", "188.114.97.3", "3.5.216.71" ], "asns": [ "13335", "16509" ], "countries": [ "SE" ], "link_domains": [ "www.cloudflare.com" ], "doc_hash": "617282963ee9d891f8ac1a7415e1ee153eed97c8fc2c18e420ea5292e94cb56d", "script_hashes": [ "5281a0160797c5b3bd1b98b37de898f8ec6a41be568f8e086db996d6b7108a73", "2121e62ba5e59326f1ddfa53ee67212f97ada989f486a49234be8fe70f326894" ], "globals": [ "requestResize", "_cf_chl_opt", "NIEP3", "pNSi5", "cVqg7", "mGhI7", "tnAvq1", "WCMuS9", "xdiN1", "SMMhU4", "naaL6", "BLJTh7", "hfBu8", "QIXeq5", "VNlR0", "igejn0", "VMrVP1", "SJTZs9", "BGgf6", "SSvM5", "HxNX2", "zaERg6", "dANz7", "FqKZG4", "runProgram", "RxhA2", "xPLd9", "PQak3", "nJcY5", "UJHyt4", "ivIh5", "angular", "OYfX3", "CPve4", "GWews8", "turnstile", "nbvy2", "IusvE4", "PhDm6", "EQXLS5" ], "cookies": [ "cf_clearance", "cf_chl_rc_ni" ], "domain_age_days": 6, "apex_age_days": 6, "tls_age_days": 6, "tls_valid_days": 89, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 28, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "AmazonS3", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T19:42:35Z", "uuid": "5418b37f-6ea0-42f2-b99f-958937ac71f8", "scanned_at": "2026-10-02T15:30:53Z", "final_url": "https://wallet-defender.es/", "doc_hash": "98ccb30d01aa327c9505a302f509690225c7498331c08a1a864dbc7f705a9289" }, "vt": { "v": 1, "fetched_at": "2026-10-21T14:49:06Z", "analysis_at": "2026-10-19T08:58:29Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "first_seen": "2026-09-24T08:45:55Z", "dns": [ { "ttl": 900, "type": "A", "value": "185.53.179.136" }, { "ttl": 900, "type": "SOA", "rname": "noreply.registrar.eu", "value": "ina1.registrar.eu" }, { "ttl": 900, "type": "NS", "value": "ina1.registrar.eu" }, { "ttl": 900, "type": "NS", "value": "ina2.registrar.eu" }, { "ttl": 900, "type": "NS", "value": "ina3.registrar.eu" } ], "dns_at": "2026-10-19T09:00:51Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.wallet-defender.es", "wallet-defender.es" ], "issuer": "Let's Encrypt / YE2", "serial": "50744a08c8e7e3e97a1b2f4368aa8aaaa22", "sha256": "12eb53ec8d4d92db2544c78e301a53df354958321b1082062ee80d32c83aeda6", "subject": "wallet-defender.es", "valid_to": "2026-12-23T07:14:15Z", "valid_from": "2026-09-24T07:14:16Z" } } } ```