mw-wallet[.]io

mw-wallet.io was registered through GoDaddy.com, LLC on 21 February 2026. The authoritative name servers are lady.ns.cloudflare.com and simon.ns.cloudflare.com, and the domain resolves to the Cloudflare edge address 188.114.96.3, located in the United States under ASN 13335. The site presents an SSL certificate issued by Google Trust Services (WE1), consistent with Cloudflare‑provided TLS termination. An HTTP GET returns status 200 and the page title is “MW Wallet”, indicating a front‑end that purports to be a cryptocurrency wallet. The listed technologies include jsDelivr, Cloudflare, and HTTP/3, all of which are commonly used for content delivery and do not themselves imply malicious intent.

Threat intelligence classifies the site as a “crypto drainer” and the risk level is marked high. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis shows three of ninety‑three scanning engines flag the domain, confirming the presence of at least one detectable malicious component. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple security vendors have observed abusive activity. The combination of a recent registration date, low trust score, detection by several anti‑phishing products, and the “MW Wallet” title strongly suggests that the domain is being used to lure victims into connecting a cryptocurrency wallet and then illicitly transferring assets.

However, the current public information does not include payload samples, specific phishing pages, or indicators of compromise beyond the domain itself, leaving the exact attack flow uncertain. Defenders should prioritize blocking mw-wallet.io at network perimeter and DNS resolvers, enforce TLS inspection to verify the Google Trust Services certificate, and add the IP address 188.114.96.3 to block lists.