Domain security and threat intelligence

walletelectrum.com

Name: walletelectrum.com — PhishDestroy evidence record
Published: 2026-10-23
License: https://creativecommons.org/licenses/by/4.0/

In short

walletelectrum.com is a seed phrase phishing page detected by PhishDestroy on 2026-10-23. Risk: critical (100/100). Registrar: INWX. Status: Last known active. Hosting: DigitalOcean, LLC. PhishDestroy sent 1 abuse report. VirusTotal: 14/92 engines flag it. Do not enter credentials or connect a wallet.

“Wallet Electrum”

Review the evidence

Registrar: INWX
Resolved IP: 164.92.92.171
Registered: Aug 10, 2025

PhishDestroy assessment Critical

100/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Oct 24, 22:28 UTC· HTTP probe

Record details & risk signals

OTX: 4 refs Oct 23, 2026 1 Report Sent

Risk signals

VirusTotal detections: 14/92 Stored blocklist matches: 2 Automated brand label: Ledger

ABUSE NOTICE · 24H+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.

Notification and current-status evidence

The sent-report ledger records the first outgoing report at 2026-10-23 02:17:56 UTC. The recorded recipient is abuse@digitalocean.com. The latest stored availability evidence still shows the domain reachable; 44 hours has elapsed since the first outgoing report.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Elapsed since first report

44 hours

Reports sent

Latest case ID

PD-20261023-40309B

Current status

HTTP 200 at latest stored check

Network Security Intelligence

Cloudflare Radar Verdict Malicious

Phishing

Analysis

PhishDestroy threat report2026-10-23 14:44:53 UTC

Overview

PhishDestroy’s automated assessment classifies walletelectrum.com as a seed‑phrase theft page. The recorded page title was “Wallet Electrum”. The domain first appeared in PhishDestroy’s feed on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works

In a seed‑phrase theft scheme the attacker presents a wallet‑like interface and asks the visitor to enter the recovery seed or private key. When the phrase is submitted the attacker can reconstruct the wallet and move any funds without further interaction.

Evidence

VirusTotal scanned the domain on 2026-10-22 and reported 13 malicious and 1 suspicious detections out of 92 engines. Flagging vendors included AlphaMountain.ai, Bfore.Ai PreCrime, BitDefender, Chong Lua Dao, CyRadar, Emsisoft, Fortinet, G-Data, Lionic, Netcraft, Sophos and VIPRE. Google Safe Browsing showed no flag on 2026-10-23; urlscan.io gave a clean overall verdict on 2026-10-21 but its engine score marked the URL malicious (score 97). Cloudflare Radar flagged it as phishing on 2026-10-23, external blocklists MetaMask and SEAL listed it, PhishDestroy’s internal list includes it, and OTX cited four pulses.

Infrastructure

The domain was registered on 2025-08-10 through INWX GmbH. The recorded IP was 164.92.92.171, which belongs to DigitalOcean, LLC in the United States. TLS 1.3 was observed with a ZeroSSL certificate valid from 2026-08-23 to 2026-11-21, the web server identified itself as Apache, and the page loaded jQuery and prettyPhoto libraries; nameservers were ns1.dnsprotector.xyz and ns2.dnsprotector.xyz and DNSSEC was not enabled.

What to do

Anyone who entered a seed phrase on this site should treat the wallet as compromised, create a new wallet and transfer any assets, discarding the exposed phrase. Defenders should block connections to walletelectrum.com, add the domain to internal blocklists, and review access logs for related traffic.

Source evidenceVirusTotal 14 / 92 · OTX 4 references 5 sources

Source	Result	Recorded · UTC	Evidence
VirusTotal	14 / 92 engine detections	2026-10-23 14:41 UTC	Open report

URLQuery	2 det.		Open report

Cloudflare Radar	Phishing	2026-10-23 02:41 UTC	Open report

OTX	4 community references	2026-10-23 14:41 UTC	Open report

URLScan	No malicious flag	2026-10-23 02:06 UTC	Open report

Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.

Questions about walletelectrum.com

Is walletelectrum.com legit?

No. PhishDestroy classifies walletelectrum.com as a seed phrase phishing page (risk: critical, 100/100); it was first detected on 2026-10-23. VirusTotal: 14/92 engines flag it. Treat the site as unsafe.

Is walletelectrum.com safe to connect a wallet?

No. Do not connect a wallet, sign messages or approve tokens on walletelectrum.com. Phishing sites ask for approvals (approve, setApprovalForAll, Permit2) that let the operator move your assets, and a confirmed transaction cannot be reversed.

What should I do if I used walletelectrum.com?

Change every password you entered there and turn on two-factor authentication. If you connected a wallet or signed something, revoke the approvals and move the remaining funds to a new wallet; never share your seed phrase. Step-by-step help: emergency guide.

Explore

Blocklist matchesMetaMask · PhishDestroy · SEAL 3

MetaMask Listed View source

PhishDestroy PhishDestroy list View source

SEAL Listed View source

Last checked 2026-10-24 22:20:01 UTC

Stored Capture · 11 captures

Screenshot of walletelectrum.com — **Primary capture**2026-10-23 02:06 UTC 1 / 11

SourcePrimary capture

Recorded2026-10-23 02:06 UTC

StateStored capture

HTTP statusNot recorded for this capture

Final URLNot recorded for this capture

Position1 / 11

Open capture Wayback Download

Domain details

Domain

URLScan verdict Analysis completed score 0 report ↗

IP Reputation abuse score 0/100 0 reports checked Oct 23, 2026

OTX tags 2026-10activeall-domainsblocklistcontentcryptodomainsdrainerfraudlivemonthlyphishdestroyphishingscam

Registrar INWX

(IN)

Abuse contactabuse@digitalocean.com, abuse@domrobot.com, abuse@inwx.com

ICANN RegistryICANN Lookup (RDAP) →

WHOIS LookupICANN RDAP for walletelectrum.com →

RegistrationCreated Aug 10, 2025 — Expires Aug 10, 2027

HTTP Status200

Technical detailsProvenance & timestamps

First DetectedOct 23, 2026

DOM Analysisanalyzed Oct 23, 2026score 100/1003 brand signals

Submitted URLhttp://walletelectrum.com/

Favicon Hash

Case ID

Observed page title

Wallet Electrum

Automated brand references

Across Ledger Trezor

TLS Certificate

Issued by ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2 · stored validity ends in 28 days

Network & certificates

Stored technical evidence

Network & DNS

Resolved IP: 164.92.92.171
Network ASN: AS14061
Organization: DigitalOcean, LLC
Observed location: Santa Clara, US
Server header: Apache

Nameservers 2

ns1.dnsprotector.xyz
ns2.dnsprotector.xyz

Location describes the IP network.

TLS certificate

Issuer: ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2
Valid from: 2026-08-23 00:00:00
Valid until: 2026-11-21 23:59:59
Hostname coverage: Stored certificate dates valid
Validity: Within stored validity dates
Collection source: PhishDestroy collector

Certificate fingerprint

cb8b109b9db067029adeb434c08da3364a964b756bc4b53294f494defe45d7a7

Certificate names · 2 SANs

walletelectrum.com
www.walletelectrum.com

Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.

viewdns.info · 164.92.92.171 rapiddns.io

Latest Classified Outcome 2026-10-24 10:30:53 UTC

Primary outcome Live content reason: Ordinary HTTP content served 90% confidence

Attribution source: Current Http Probe

Evidence layers Availability: Content serving Content: Content served at root DNS: Resolved Registration: Unknown

Latest HTTP observation Live content Ordinary HTTP content served 90% 2026-10-24 10:30:53 UTC

RDAP registration Unknown

Observed timeline last reachable: 2026-10-24 10:30:53 UTC last content: 2026-10-24 10:30:53 UTC

Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.

Recorded subdomains1

Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.

www.walletelectrum.comDomain record

The original observation time is not recorded for these hostnames.

Report This Domain Submit evidence & help protect others

VirusTotal Analysis

14 / 92 security vendors flagged this domain

View on VT

Last analyzed 2026-10-23 14:41:03 UTC First positive detection 2026-10-23 02:40:24 UTC Previous stored snapshot: 14 detections

alphaMountain.ai

Bfore.Ai PreCrime

BitDefender

Chong Lua Dao

CyRadar

ESET

Emsisoft

Fortinet

G-Data

Lionic

Netcraft

Sophos

VIPRE

Webroot

Archived Evidence

Wayback Machine Snapshot

Oct 23, 2026 · 01:42 UTC

View Archive

Site Performance Analysis

Google PageSpeed Insights — mobile performance audit of walletelectrum.com · checked Oct 23, 2026

Good

Performance

FCP

1.23 s

First Contentful Paint

LCP

1.5 s

Largest Contentful Paint

CLS

Cumulative Layout Shift

TBT

0 ms

Total Blocking Time

3.31 s

Speed Index

Stored Capture Evidence 1 snapshot

Timestamped response metadata retained by the local collection pipeline. Each value below belongs to the displayed archive time.

Archived HTTP response HTTP 200

Requested URL: http://walletelectrum.com/

Crypto Wallet Electrum | Secure Bitcoin Wallet

Crypto wallet Electrum is a lightweight Bitcoin wallet for secure BTC management, fast access, private key control, hardware wallets, and flexible self-custody.

Response
HTTP 200

HTML body
14.4 KB

Compressed
3.5 KB

Links
7 internal · 2 external

Detected technologies

jquerynginx

Selected response headers

Server: nginx/1.24.0 (Ubuntu)

Content-Type: text/html; charset=UTF-8

Content-Encoding: gzip

HSTS: not observed DNSSEC: not observed WAF / firewall: not observed Cloaking flag: not observed

Favicon fingerprint: b9a107d0716183fd98439b93a93643856b7774342f36cf9afcd6a83419c6f38d

Saved response-header values · 9

Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3549
Content-Type: text/html; charset=UTF-8
Date: Fri, 23 Oct 2026 01:45:15 GMT
Server: nginx/1.24.0 (Ubuntu)
Upgrade: h2
Vary: Accept-Encoding
X-Cache-Status: HIT

Values retained by the collector; long values may be shortened during collection.

Registration & observation details3

Availability observations

Last reachable observation: 2026-10-24 10:30:53 UTC
Last content observation: 2026-10-24 10:30:53 UTC
Estimate basis: Currently reachable

An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.

Collected source details

Stored page, network and scanner observations, grouped by source and observation time.

Every stored field, with its source and date

URLScan · 2026-10-23T02:04:30Z

Observed: 2026-10-23T02:04:30Z · Retrieved: 2026-10-23T02:48:48Z

Uuid	01a16680-8e4f-72c2-8ce6-f4951c819c49
Final url	https://walletelectrum.com/
Status	200
Redirected	https-only
Redirects	[ { "to": "https://walletelectrum.com/", "from": "http://walletelectrum.com/", "status": 307 } ]
Ip	164.92.92.171
Ptr	edge01.dnsprotector.xyz
Contacted IP addresses	[ "164.92.92.171" ]
Asns	[ "14061" ]
Countries	[ "US" ]
Linked domains	[ "github.com", "twitter.com" ]
Social	[ "https://github.com/spesmilo/electrum", "https://twitter.com/ElectrumWallet" ]
Document hash	fa94db2be89f560da95e8a83e0cb3c501563b091fc579d568f7f46e93844c493
Script hashes	[ "88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd", "1cd02bdd539cb152085e4e1583428bcb06c8128a9ec912195f8a42ed8179804f", "340277869a89746ff06a46d7a773d8b87708a32da1669635ddafec18aaea1ed3", "2ba539e4613c4c42f91845d6a05e44f8c93ec4936711b05cffae8a4f92c8a652", "bb7cd75130058d4e9f6226a758f9671c9a2d4d061760a78c822b997ceeb25f35", "6967ea3008cb1a82beafedfd1cc2871c3cdd4c5b4de87b97c5ee6c4f8a6aa942", "443e5dd56c9d7e9410ad662dcefbe078bf42dcb46eada4416cb7eb05d386f5c3" ]
Globals	[ "$", "jQuery", "pp_alreadyInitialized", "QRCode" ]
Tls	{ "san": [ "walletelectrum.com", "www.walletelectrum.com" ], "cipher": "AES_256_GCM", "issuer": "ZeroSSL RSA DV SSL CA 2", "subject": "walletelectrum.com", "protocol": "TLS 1.3", "valid_to": "2026-11-21T23:59:59Z", "valid_from": "2026-08-23T00:00:00Z" }
Domain age days	2361
Apex age days	2361
Tls age days	61
Tls valid days	90
Requests	27
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "server": "Apache", "content-type": "text/html; charset=UTF-8" }

Cloudflare Radar · 2026-10-23T02:41:18Z

Observed: 2026-10-23T02:41:18Z · Retrieved: 2026-10-23T02:48:49Z

Uuid	ba229517-efa9-4844-85f5-7cce78ef90a3
Final url	https://walletelectrum.com/
History	[ { "url": "https://walletelectrum.com/", "status": 0 } ]
DOM structure hash	f7a48cc844a2898cdb50aa55394e2633ea45e5ef13dc1aed1292ed349b65d815
Url risks	[ "Phishing" ]
Radar rank	{ "bucket": ">200000" }
DNS records	[ { "name": "walletelectrum.com", "type": "A", "value": "164.92.92.171" } ]
Dnssec valid	false
Verdict	{ "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }
Registration record	{ "registrar": "INWX GmbH", "created": "2025-08-10T17:54:59Z", "updated": "2026-08-23T23:00:43Z", "expires": "2027-08-10T17:54:59Z", "nameservers": [ "ns1.dnsprotector.xyz", "ns2.dnsprotector.xyz" ] }

VirusTotal · 2026-10-22T11:12:16Z

Observed: 2026-10-22T11:12:16Z · Retrieved: 2026-10-23T14:40:53Z

Vendor result counts	{ "timeout": 0, "harmless": 45, "malicious": 13, "suspicious": 1, "undetected": 33 }
Vendor labels	{ "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "malicious", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Bfore.Ai PreCrime": "malicious" }
Reputation	0
Categories	{ "alphaMountain.ai": "Phishing (alphaMountain.ai)" }
Registrar	INWX GmbH
Created	2025-08-10T17:54:59Z
Expires	2027-08-10T17:54:59Z
Updated	2026-08-23T23:00:43Z
First seen	2025-08-12T16:04:54Z
DNS records	[ { "ttl": 3600, "type": "NS", "value": "ns2.dnsprotector.xyz" }, { "ttl": 3600, "type": "NS", "value": "ns1.dnsprotector.xyz" }, { "ttl": 300, "type": "A", "value": "164.92.92.171" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.walletelectrum.com", "value": "a.misconfigured.dns.server.invalid" } ]
Dns at	2026-10-22T11:12:37Z
Jarm	3fd3fd16d3fd3fd21c42d42d000000a8d52b2e606af78e33e5cbcbcdeb78a6
Certificate	{ "san": [ "walletelectrum.com", "www.walletelectrum.com" ], "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2", "serial": "4ddd603a2e7ad86b84002809ebdbeca9", "sha256": "cb8b109b9db067029adeb434c08da3364a964b756bc4b53294f494defe45d7a7", "subject": "walletelectrum.com", "valid_to": "2026-11-21T23:59:59Z", "valid_from": "2026-08-23T00:00:00Z" }
Registration record	{ "registrar": "INWX GmbH", "registrar_iana_id": "1420", "registrar_url": "http://www.inwx.com", "created": "2025-08-10T17:54:59Z", "updated": "2026-08-23T23:00:43Z", "expires": "2027-08-10T17:54:59Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.dnsprotector.xyz", "ns2.dnsprotector.xyz" ], "dnssec": "unsigned" }
Registry data	{ "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-08-23T23:00:43Z", "registration": "2025-08-10T17:54:59Z", "registrar expiration": "2027-08-10T17:54:59Z", "last update of RDAP database": "2026-10-22T11:12:37Z" } }

Website checks · 2026-10-23T02:49:03Z

Mail configuration	{ "spf_lookups": 0 }
Caa records	{ "domain": "walletelectrum.com" }
Protective DNS results	{ "resolvers": 12, "blocked_count": 0 }
Web archive observations	{ "last": "2026-10-23T01:42:09Z", "first": "2020-05-06T03:56:59Z", "changes": 1, "days_archived": 2, "scans_per_day": 0, "avg_page_bytes": 4036 }
Trackers	{ "requests": 26 }
TLS connection	{ "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": false, "forward_secrecy": true }
Ports	{ "open": [ 22, 53, 80, 443 ] }
Dns server	{ "ns": [ { "ip": "164.92.92.171", "host": "ns2.dnsprotector.xyz" }, { "ip": "164.92.92.171", "host": "ns1.dnsprotector.xyz" } ], "zone": "walletelectrum.com" }
Location	{ "ip": "164.92.92.171", "asn": "14061", "org": "DigitalOcean, LLC", "city": "Santa Clara", "country": "US" }
Ssl	{ "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2", "subject": "walletelectrum.com" }
DNS records	{ "A": [ "164.92.92.171" ], "NS": [ "ns1.dnsprotector.xyz", "ns2.dnsprotector.xyz" ], "SOA": "{\"nsname\": \"a.misconfigured.dns.server.invalid\", \"hostmaster\": \"hostmaster.walletelectrum.com\", \"serial\": 2026082304, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}" }
Dnssec	{ "ds": false, "rrsig": false, "dnskey": false }
Get ip	{ "ip": "164.92.92.171", "family": 4 }
Subdomains	{ "count": 1, "subdomains": [ "www.walletelectrum.com" ] }
Tech stack	{ "technologies": [ "Apache HTTP Server", "prettyPhoto", "jQuery" ] }
Registration record	{ "registrar": "INWX GmbH", "created": "2025-08-10T17:54:59Z", "updated": "2026-08-23T23:00:43Z", "expires": "2027-08-10T17:54:59Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dnsprotector.xyz", "ns2.dnsprotector.xyz" ] }

Stored observation history3

Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.

2026-10-24 10:30:53 UTC
Availability monitor · Recorded state
Unknown→live_content

content_served
2026-10-23 10:34:09 UTC
Availability monitor · Recorded state
Unknown→live_content

content_served
2026-10-23 02:06:07 UTC
Availability monitor · First collection record
Reachable

Recorded activity

7 entries

AlienVault OTX
4 community references
View source
2026-10-23 14:41:37 UTC
VirusTotal
14/92 engine detections
View source
2026-10-23 14:41:03 UTC
Cloudflare Radar
Phishing
View source
2026-10-23 02:41:18 UTC
Abuse report sent
PD-20261023-40309B

abuse@digitalocean.com

2026-10-23 02:17:56 UTC
Added to PhishDestroy
walletelectrum.com
View source
2026-10-23 02:06:07 UTC
URLScan
Page captured
View source
2026-10-23 02:06:07 UTC
Wayback Machine
Page archived
View source
2026-10-23 01:42:09 UTC

Lookalike domains

151 stored lookalike domains

ledfger.com insertion Internal report ledgfer.com insertion Internal report ledgher.com insertion Internal report ledgrr.com replacement Internal report lefdger.com insertion Internal report lesdger.com insertion Internal report lkedger.com insertion Internal report lredger.com insertion Internal report lwedger.com insertion Internal report xn--ledgr-9za.com homoglyph Internal report ledgerk.com addition Internal report edger.com omission

Show all (88)

eldger.com transposition kedger.com replacement kledger.com insertion l3dger.com replacement ldeger.com transposition ldger.com omission le.dger.com subdomain lecger.com replacement ledber.com replacement ledegr.com transposition leder.com omission ledg3r.com replacement ledge.com omission ledged.com replacement ledgedr.com insertion ledgee.com replacement ledgeer.com repetition ledgercom.com various ledget.com replacement ledgewr.com insertion ledgger.com repetition ledgir.com vowel-swap ledgor.com vowel-swap ledgr.com omission ledgre.com transposition ledgrer.com insertion ledgsr.com replacement ledgwer.com insertion ledgwr.com replacement ledher.com replacement ledhger.com insertion ledsger.com insertion ledtger.com insertion ledyer.com replacement ledzer.com replacement leedger.com insertion legder.com transposition leger.com omission lerdger.com insertion lerger.com replacement lesger.com replacement lewdger.com insertion lidger.com vowel-swap lledger.com repetition lodger.com vowel-swap lrdger.com replacement lsdger.com replacement oedger.com replacement pedger.com replacement pledger.com insertion dedger.com bitsquatting hedger.com bitsquatting iedger.com homoglyph l-edger.com hyphenation ladger.com bitsquatting lcdlger.com homoglyph lddger.com bitsquatting lebger.com homoglyph leclger.com homoglyph ledcer.com bitsquatting leddger.com insertion ledeer.com bitsquatting ledeger.com insertion ledfer.com bitsquatting ledg-er.com hyphenation ledgar.com bitsquatting ledger0.com addition ledger1.com addition ledger4.com addition ledger5.com addition ledger6.com addition ledgerb.com addition ledgerc.com addition ledgerf.com addition ledgeri.com addition ledgern.com addition ledgerq.com addition ledgerx.com addition ledges.com bitsquatting ledgez.com bitsquatting ledgur.com bitsquatting lediger.com homoglyph ledqer.com homoglyph leeger.com bitsquatting leelger.com homoglyph lefger.com bitsquatting letger.com bitsquatting ludger.com bitsquatting

Showing 100 of 151

Related Infrastructure & Reports

Infrastructure map · walletelectrum.com

Same favicon Direct link 2
- electrume.at 17 VT · Jul 6, 2026
- cryptowalletelectrum.com 1 VT · Oct 23, 2026
Same IP 164.92.92.171 Supporting signal 1
- cryptowalletelectrum.com 1 VT · Oct 23, 2026
Brand label: Ledger Supporting signal 8
- home-ledgrreliveapp.typedream.app 24 VT · Oct 6, 2026
- portal-liv-e-ap-p-ledger.typedream.app 24 VT · Jul 12, 2026
- en-ledgerlive.vercel.app 23 VT · Dec 17, 2025
Registrar: INWX Discovery only 6
- cryptowalletelectrum.com 1 VT · Oct 23, 2026
- rainbet-hungary.net 14 VT · Oct 14, 2026
- minihungary.eu 12 VT · Oct 12, 2026

Direct link — Same registrable domain, favicon file or phishing kit.
Supporting signal — Shares infrastructure or a target brand; not proof of one operator.
Discovery only — Same registrar or CDN edge: listed for navigation, not evidence of a link.

Each lane is one reason a domain is linked to this host. Node size marks VirusTotal detections and dashed nodes are already offline. The full lists follow below. Full list of related reports

Domain	Relationship	Recorded	Record
electrume.at	Content matchesfavicon	2026-07-06 12:18:13 UTC	All fields Domain electrume.at Vt detections 17 Detected at 2026-07-06 14:18:13 Status enriched Favicon url https://og.phishdestroy.io/favicons/96fdc7d88df05e8efecc44a5f051df74.png Favicon hash 96fdc7d88df05e8efecc44a5f051df74 Match type favicon
cryptowalletelectrum.com	Content matchesfavicon	2026-10-23 01:34:49 UTC	All fields Domain cryptowalletelectrum.com Vt detections 1 Detected at 2026-10-23 03:34:49 Status enriched Favicon url https://og.phishdestroy.io/favicons/96fdc7d88df05e8efecc44a5f051df74.png Favicon hash 96fdc7d88df05e8efecc44a5f051df74 Match type favicon
cryptowalletelectrum.com	Same IP	2026-10-23 01:34:49 UTC	All fields Domain cryptowalletelectrum.com Vt detections 1 Detected at 2026-10-23 03:34:49 Favicon url https://og.phishdestroy.io/favicons/96fdc7d88df05e8efecc44a5f051df74.png Favicon hash 96fdc7d88df05e8efecc44a5f051df74
home-ledgrreliveapp.typedream.app	Same automated brand label	2026-10-06 21:09:27 UTC	All fields Domain home-ledgrreliveapp.typedream.app Vt detections 24 Detected at 2026-10-06 23:09:27 Favicon url https://og.phishdestroy.io/favicons/9af1511d8580dd210e47c33a74a00354.jpg Favicon hash 9af1511d8580dd210e47c33a74a00354 Drainer type clean
portal-liv-e-ap-p-ledger.typedream.app	Same automated brand label	2026-07-12 12:24:09 UTC	All fields Domain portal-liv-e-ap-p-ledger.typedream.app Vt detections 24 Detected at 2026-07-12 14:24:09 Favicon url https://og.phishdestroy.io/favicons/c213d299a2638391440eff20c8cf0b8f.svg Favicon hash c213d299a2638391440eff20c8cf0b8f Drainer type clean
en-ledgerlive.vercel.app	Same automated brand label	2025-12-17 19:54:44 UTC	All fields Domain en-ledgerlive.vercel.app Vt detections 23 Detected at 2025-12-17 20:54:44 Drainer type clean
ledger.com.af	Same automated brand label	2026-02-07 10:48:59 UTC	All fields Domain ledger.com.af Vt detections 23 Detected at 2026-02-07 11:48:59
ledger.recovery.5930217.com	Same automated brand label	2025-12-07 14:12:37 UTC	All fields Domain ledger.recovery.5930217.com Vt detections 23 Detected at 2025-12-07 15:12:37 Drainer type clean
ledgerglobai.com	Same automated brand label	2026-02-07 10:50:58 UTC	All fields Domain ledgerglobai.com Vt detections 23 Detected at 2026-02-07 11:50:58
liveassethelpdesk.com	Same automated brand label	2026-04-09 02:04:05 UTC	All fields Domain liveassethelpdesk.com Vt detections 23 Detected at 2026-04-09 04:04:05 Drainer type clean
begin-ledger-support.typedream.app	Same automated brand label	2026-07-12 11:24:15 UTC	All fields Domain begin-ledger-support.typedream.app Vt detections 22 Detected at 2026-07-12 13:24:15 Favicon url https://og.phishdestroy.io/favicons/c213d299a2638391440eff20c8cf0b8f.svg Favicon hash c213d299a2638391440eff20c8cf0b8f Drainer type clean
cryptowalletelectrum.com	Same registrar	2026-10-23 01:34:49 UTC	All fields Domain cryptowalletelectrum.com Vt detections 1 Detected at 2026-10-23 03:34:49 Favicon url https://og.phishdestroy.io/favicons/96fdc7d88df05e8efecc44a5f051df74.png Favicon hash 96fdc7d88df05e8efecc44a5f051df74
rainbet-hungary.net	Same registrar	2026-10-14 19:56:36 UTC	All fields Domain rainbet-hungary.net Vt detections 14 Detected at 2026-10-14 21:56:36 Favicon url https://og.phishdestroy.io/favicons/dc49662909e43895a0e41f0fcb71d950.png Favicon hash dc49662909e43895a0e41f0fcb71d950
minihungary.eu	Same registrar	2026-10-12 21:34:39 UTC	All fields Domain minihungary.eu Vt detections 12 Detected at 2026-10-12 23:34:39 Favicon url https://og.phishdestroy.io/favicons/ea17313e8a98dfdf5431a2cec8fb0036.webp Favicon hash ea17313e8a98dfdf5431a2cec8fb0036
traderoomers.com	Same registrar	2026-10-11 12:51:58 UTC	All fields Domain traderoomers.com Vt detections 6 Detected at 2026-10-11 14:51:58 Favicon url https://og.phishdestroy.io/favicons/c213d299a2638391440eff20c8cf0b8f.svg Favicon hash c213d299a2638391440eff20c8cf0b8f
pastefy.app	Same registrar	2026-10-11 12:24:03 UTC	All fields Domain pastefy.app Vt detections 14 Detected at 2026-10-11 14:24:03 Favicon url https://og.phishdestroy.io/favicons/1357c94178c50badaa1ef1532bfd5121.ico Favicon hash 1357c94178c50badaa1ef1532bfd5121
chainsecurity.eu	Same registrar	2026-10-08 00:15:54 UTC	All fields Domain chainsecurity.eu Vt detections 3 Detected at 2026-10-08 02:15:54 Favicon url https://og.phishdestroy.io/favicons/c213d299a2638391440eff20c8cf0b8f.svg Favicon hash c213d299a2638391440eff20c8cf0b8f

Relationship context and original groups

Check for cloaking

Compare what a browser and a crawler receive, and check for Keitaro traffic routing.

walletelectrum.com

Evidence & External Reports

Security Analysis

URLScan Analyzed VirusTotal 14 det. ChainPatrol URLQuery 2 det. SSL Labs Stored certificate dates valid CF Radar Malicious OTX 4 refs WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

Submitted Evidence Snapshot

Sent: 2026-10-23 02:17:56 UTC Ledger records: 1 Case ID: PD-20261023-40309B Recipient: abuse@digitalocean.com

Page title stored with report: Wallet Electrum

URLScan evidence VirusTotal evidence URLQuery evidence Screenshot 163.7 KB

PDF notice generated Notice text archived (330 chars)

Abuse notice text as sent to the provider

Registrar: INWX GmbH & Co. KG (Germany)
Policy Violations: “Acceptable Use Policy prohibits phishing, identity fraud, malware and other illegal activities; registrar reserves the right to disable DNS or revoke domains used for abuse.”
Applicable Laws: German StGB §§202a–c; §263; EU Directive 2013/40/EU; ICANN DNS Abuse Framework

OSINT & Intelligence

Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback 2026-10-23

DNS & Network

nslookup.io DNS bgp.tools ASN/Route

SEO & Domain

SpyFu Moz DA/PA Ahrefs Backlinks

Deep Analysis

Help & reporting

Were You Affected by This Site?

6 evidence signal groups linked 1 stored notification records Last known active

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

Immediate steps Find reporting contacts

Official reporting routes

FBI IC3

Report internet-enabled crime in the United States

IC3 does not accept attachments. Keep original evidence for investigators. IC3 guidance

Federal tips line1-800-CALL-FBI

Report online

Europol

Find the official reporting channel for your EU country

National police directory

Find your country

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Current service: Report Fraud. England, Wales and Northern Ireland. Scotland: 101.

Contact centre0300 123 2040

Report online

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft · optional AI wording assistance requires separate consent

Template-based draft • optional AI wording assistance requires separate consent · Review and submit it yourself

After a phishing incident

Recommendations & Advice for Victims

Choose the steps that match what you shared. Keep a copy of this report alongside your own records.

What should I do immediately?

Urgent

Stop using the suspicious site. Open the real service through its official app or an address you already trust.

Change all passwords — email, exchange accounts, anything that shares the same password
Enable 2FA using an authenticator app (not SMS). Disable SMS-based recovery
Freeze cards if you entered banking details on the phishing site

What information should I collect for my report?

FBI guidelines

Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗

Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Exact dates & times — of each transaction and first contact with scammer
Screenshots — scam website, chat messages, emails, wallet transactions, social media
All URLs & domains used by the scammer (including walletelectrum.com)
Communications — emails, texts, phone numbers, usernames the scammer used

Even if you don't have all details — file a report anyway. Partial information still helps investigations.

Where should I report the scam?

FBI IC3 — Internet Crime Complaint Center (US federal reporting)
Europol — European cybercrime reporting (EU)
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
Local police — creates an official record, even if they can't act immediately

A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.

How do phishing scams typically work?

Fake websites — pixel-perfect clones of legitimate sites with slightly altered domains
Pig butchering — trust built over weeks via Telegram/WhatsApp/dating apps, then money stolen
Recovery scams — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
AI-powered scams — deepfakes, automated phishing, and AI-generated sites making fraud harder to detect

How can I protect myself in the future?

Bookmark official sites — never click links from emails, DMs, or ads
Verify domains — check on PhishDestroy before interacting. Check HTTPS, spelling, domain age
"Too good to be true" = scam — guaranteed returns, celebrity endorsements, urgent deadlines

Further guidance: NIST · phishing response FBI IC3 · reports & evidence FTC · recovery scams

Check Any Domain

Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence

Scan Now

Report Phishing

Submit suspicious domains to our threat database — protect the community

Report

Live Threat Feed

Recent phishing reports and observed availability changes

Monitor

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

About this reportSources, observation dates and corrections

This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.

The AI-assisted analysis was written on 2026-10-23 14:44:53 UTC. It describes the evidence available at that time; later source checks can change.

A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.

Request a correction or appeal How PhishDestroy works

Embed this reportA compact widget with a link to the evidence

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/walletelectrum.com"
  title="PhishDestroy threat report for walletelectrum.com"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>