lostwallet[.]lol

The domain lostwallet.lol was registered on 21 February 2026 through Web Commerce Communications Ltd. It resolves to the Cloudflare address 172.67.223.203, which is announced by AS13335 in the United States. The site currently returns an HTTP status indicating it has been taken offline, and the SSL certificate presented is identified as WE1. A Gridinsoft trust score of 0 / 100 marks the domain as highly untrusted. The page title retrieved from the site before it was taken down reads “LostWallet | The Ultimate App for Mining Forgotten Crypto Wallets,” and the listed scam type is “Wallet/Seed Phishing.” The domain is flagged as a brand‑impersonation campaign targeting the brand Across, consistent with the “Impersonates: across” label in the intelligence feed.

Four of ninety‑five security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist, specifically PhishDestroy. The low detection count, combined with the zero trust score and the hostile page title, suggests the domain was used to lure victims into disclosing cryptocurrency wallet seeds or private keys. No additional payload or hosting artifacts have been observed because the site is no longer reachable. Defenders should treat lostwallet.lol as a confirmed malicious infrastructure element.

Immediate actions include adding the domain and its resolving IP address to blocklists at the firewall and DNS filtering layers, updating endpoint protection signatures to reflect the four VirusTotal detections, and monitoring for any resurgence of the domain or related sub‑domains under the same registrar. Continuous observation of Cloudflare‑hosted assets linked to the AS13335 prefix is advised, as the attacker may shift to new hostnames while retaining the same infrastructure. Because the site is offline, further forensic analysis of the page content is limited, and investigators should request historical snapshots from web archives if deeper malware attribution is required.